Govt Warns Against Restoring Hacked Systems

Pakistan's National Cyber Emergency Response Team (National CERT) has directed administration organizations to preserve digital evidence during cybersecurity investigations, warning that changes to system records could compromise forensic analysis of cyber incidents.

Key points

• The handbook additionally refers to the CERT Rules 2023, under which cybersecurity incidents must be noted through approved channels, including organizational, provincial or sectoral CERTs.
• Organizations have additionally been instructed to implement emergency containment measures and remediation guidance issued by National CERT investigation teams.
• Employees have been advised not to modify or overwrite system audit logs, firewall records or disk memory dumps before investigation teams collect them.
• Relevant personnel must additionally provide investigators with operational details, network diagrams and timelines of the incident to backing the forensic process.
• National CERT has cautioned administration entities against allowing unverified third-party vendors or unauthorized personnel to interfere with systems isolated during an active investigation.

Under the National Cybersecurity Handbook 2026-27, administration entities are required to cooperate with National CERT-led investigations by providing timely physical and administrative access to affected infrastructure and relevant technical records. Pakistan Invites US to Enter Balochistan.

For context, the guidelines state that detailed investigations and digital forensics are essential to determine the causes of security breaches, assess their impact and support contain cyber threats. Don't Alter System Logs.

Meanwhile, the handbook instructs administration personnel to maintain a proper chain of custody for affected devices and storage media so that digital evidence remains intact and traceable throughout an investigation.

Employees have been advised not to modify or overwrite system audit logs, firewall records or disk memory dumps before investigation teams collect them. Such changes could undermine efforts to reconstruct incidents and establish how a breach occurred.

According to the handbook, affected services must not be restored and disconnected network segments must not be reconnected until formal security clearance has been granted. The requirement is intended to prevent systems from returning to operation before investigators and security teams have addressed the incident. Cyber Incidents Must Be Documented.

In practice, the handbook additionally refers to the CERT Rules 2023, under which cybersecurity incidents must be noted through approved channels, including organizational, provincial or sectoral CERTs. PIA's Rs. 5 Million Seat-Fee Fraud Finally Exposed.

Notably, the reporting and evidence-preservation requirements form part of the procedures intended to support authorities investigate cyber incidents, identify vulnerabilities and coordinate responses throughout administration organizations.

Meanwhile, the guidance places responsibility on administration entities to protect relevant records, provide investigators with the information they need and follow containment and recovery instructions until clearance is issued. Stay Connected with ProPakistani.

Obtain the latest tech news, telecom insights, and product launches wherever you prefer. Follow on Google Discover. Follow on Google News Join WhatsApp. See more ProPakistani stories in Google Search and Top Stories.

Taken together, the developments around govt Warns Against Restoring Hacked Systems point to a situation that is still moving, and the coming days should bring more clarity.