Topics in this domain
- Event vs Incident vs Breach
- Developing the Incident Response Plan
- Incident Response Team Roles and Authority
- Incident Classification and Severity Levels
- Incident Response Playbooks and Decision Trees
- Escalation and Communication Plans
- Business Impact Analysis
- RTO, RPO, MTD and Recovery Prioritisation
- Business Continuity Planning and Strategies
- Crisis Management and Continuity Governance
- Disaster Recovery Planning
- Recovery Sites: Hot, Warm and Cold
- Backup Strategies and Cloud DR
- Incident Response Training
- Testing Plans: Tabletop, Functional and Full Interruption
- Evaluating Exercises and Improving Readiness
- Security Event Detection and Monitoring Methods
- SIEM, the SOC and Event Correlation
- Threat Intelligence and Indicators of Compromise
- Incident Triage and Initial Investigation
- Evidence Preservation, Forensics and Chain of Custody
- Containment Strategies: Short-Term and Long-Term
- Making Containment Decisions
- Breach Notification and Regulatory Reporting
- External Communications: Customers, Media and Law Enforcement
- Eradication, Recovery and Return to Normal Operations
- Post-Incident Review and Root Cause Analysis
- Lessons Learned and Incident Trend Analysis
Making Containment Decisions
No free choices
Every containment option costs something. Isolating a payment server stops the attacker but also stops sales. Waiting to understand the attack keeps sales running, but risks more damage. Containment decisions are business decisions informed by technical facts.
What to weigh
- Damage if we wait: spread, data loss, legal exposure.
- Business impact of acting: downtime, lost revenue, customers affected.
- Evidence: will this action destroy what we need?
- Attacker reaction: will they escalate or destroy data if alerted?
- Safety and legal duties: physical safety, regulatory obligations.
- Confidence in scope: do we know everything that’s affected?
Who decides what
| Decision | Typical decision-maker |
|---|---|
| Isolate a workstation or server | Incident manager or SOC lead |
| Disable a privileged or executive account | Incident manager, informing the owner |
| Take a revenue-earning service offline | Executive sponsor or delegate |
| Monitor an active attacker instead of acting | Senior management, with legal advice |
| Shut down an operational (OT) process | Operations leadership; safety first |
Authority is agreed in the incident response plan, so decisions aren’t delayed.
Act now, or watch?
- Act immediately when data is leaving, ransomware is spreading or safety is at risk.
- Watch briefly when the scope is unclear and acting early would tip off the attacker and leave systems compromised.
- Watching needs senior approval, legal advice, a strict time limit and close monitoring.
- Document either way: the facts known, the options, the decision, who decided and why. Undocumented decisions look like negligence afterwards.
Example. An e-commerce site detects card-skimming code at 10 a.m. on its busiest day. Removing it means a short outage. The executive sponsor approves a 15-minute maintenance window immediately: continuing to take payments through a compromised page would breach PCI DSS and harm customers.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Main consideration in containment decisions | The damage of waiting against the impact of acting |
| Who decides to take a business service offline | The executive sponsor or business owner |
| Monitoring an attacker instead of containing | A senior management decision, with legal advice |
| Data is actively being exfiltrated | Contain immediately |
| What to record | Facts, options, the decision, the decision-maker and the reasons |
In short
- Containment decisions balance the damage of waiting against the business impact of acting.
- Factors: spread and data loss, downtime and revenue, evidence preservation, attacker reaction, safety and legal duties, confidence in scope.
- Business decisions (taking revenue-earning systems offline) belong to the executive sponsor or delegate; technical containment to the incident manager, as the plan says.
- Watching an attacker briefly to understand scope can be justified, but only as a senior management decision with legal advice.
- Every containment decision is documented with its reasons, so it can be explained later.
- When in doubt about safety or legal duties, containment takes priority over convenience.
Exam traps
- Keeping systems running to avoid disruption while data is actively leaving is rarely defensible.
- Deciding to 'watch and learn' is a senior management decision, not an analyst's.
- Undocumented decisions look like negligence afterwards.
- Containment that's technically perfect but ignores business impact loses management support.
Slides
Click the slide and use the arrow keys. F toggles full screen.
What to weigh
1 / 8