Incident Response Runbook

# 1. Block attacker IP in Vercel Dashboard
# Vercel Dashboard → Settings → Firewall → Add Rule → Block IP

# 2. Enable Cloudflare Under Attack Mode
# Cloudflare Dashboard → Security → Settings → Security Level → Under Attack

# 3. If DB compromise suspected, contact Neon support immediately
# https://neon.tech/docs/introduction/support
# Request: suspend external access to project <project-id>

-- Disable the compromised user account
UPDATE users SET role = 'Disabled' WHERE id = '<compromised_user_id>';

-- Review all activity in the past 24 hours
SELECT
  al.id,
  al.actor_id,
  u.email AS actor_email,
  al.action,
  al.entity_type,
  al.entity_id,
  al.ip_address,
  al.user_agent,
  al.timestamp
FROM audit_logs al
LEFT JOIN users u ON u.id = al.actor_id
WHERE al.timestamp > NOW() - INTERVAL '24 hours'
ORDER BY al.timestamp DESC;

-- Look specifically for PPS decryptions
SELECT * FROM audit_logs
WHERE action LIKE '%pps%' OR action LIKE '%decrypt%'
AND timestamp > NOW() - INTERVAL '24 hours';

Incident Date/Time: [UTC timestamp]
Data Categories Affected: [e.g., member names, email addresses, encrypted PPS numbers]
Estimated Number of Affected Data Subjects: [count]
Affected Pension Schemes: [scheme names or "under investigation"]
Containment Actions Taken: [list actions with timestamps]
Remediation Plan: [steps and expected completion dates]
DPC Notification Reference: [reference number once filed]

# If AUTH_SECRET is compromised (forces all sessions to invalidate)
# 1. Generate a new AUTH_SECRET
node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

# 2. Update in Vercel Dashboard
# Vercel Dashboard → Project → Settings → Environment Variables → AUTH_SECRET

# 3. Redeploy to apply new secret
vercel --prod

Subject: DORA Incident Notification — PensionsPortal.ie — [YYYY-MM-DD]

Incident Reference: [internal incident ID]
Date/Time of Detection: [UTC]
Date/Time of Occurrence (estimated): [UTC]
Systems Affected: [e.g., Production database, Authentication service]
Business Impact: [describe effect on pension scheme operations]
Containment Actions Taken: [list with timestamps]
Estimated Resolution Date: [date]
Contact for Follow-Up: [name, email, phone]

node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
# Output: a 64-character hex string — this is your new PPS_ENCRYPTION_KEY

# In Vercel Dashboard → Project → Settings → Environment Variables
# Add: PPS_ENCRYPTION_KEY_NEW = <new 64-char hex key>
# Keep: PPS_ENCRYPTION_KEY = <existing key> (do not remove)

# Requires both PPS_ENCRYPTION_KEY (old) and PPS_ENCRYPTION_KEY_NEW (new) in environment
npm run db:rotate-pps-key

-- Confirm no members still have unrotated PPS data
-- (Script should log a rotation record per member — count should match)
SELECT COUNT(*) FROM audit_logs
WHERE action = 'PPS_KEY_ROTATED'
AND timestamp > NOW() - INTERVAL '1 hour';

-- Compare against total members with PPS numbers
SELECT COUNT(*) FROM members
WHERE pps_number_encrypted IS NOT NULL;

# In Vercel Dashboard → Project → Settings → Environment Variables
# 1. Remove: PPS_ENCRYPTION_KEY (old)
# 2. Rename: PPS_ENCRYPTION_KEY_NEW → PPS_ENCRYPTION_KEY

vercel --prod

Subject: PensionsPortal.ie Service Notice — [YYYY-MM-DD]

Dear [Broker Firm Name],

We are investigating a technical issue affecting [feature/service description].

Current status: [investigating / contained / resolved]
Estimated resolution: [time estimate or "under investigation"]

We will provide a further update by [specific time].

Your data security is our priority. [If data breach: We are treating this as
a potential data protection incident and our Data Protection Officer has been
notified. We will contact you directly if your data or your clients' data
has been affected.]

If you have urgent compliance deadlines that cannot be met due to this issue,
please contact support@pensionsportal.ie and we will prioritise your case.

Regards,
PensionsPortal.ie Engineering Team