Topics in this domain
- Event vs Incident vs Breach
- Developing the Incident Response Plan
- Incident Response Team Roles and Authority
- Incident Classification and Severity Levels
- Incident Response Playbooks and Decision Trees
- Escalation and Communication Plans
- Business Impact Analysis
- RTO, RPO, MTD and Recovery Prioritisation
- Business Continuity Planning and Strategies
- Crisis Management and Continuity Governance
- Disaster Recovery Planning
- Recovery Sites: Hot, Warm and Cold
- Backup Strategies and Cloud DR
- Incident Response Training
- Testing Plans: Tabletop, Functional and Full Interruption
- Evaluating Exercises and Improving Readiness
- Security Event Detection and Monitoring Methods
- SIEM, the SOC and Event Correlation
- Threat Intelligence and Indicators of Compromise
- Incident Triage and Initial Investigation
- Evidence Preservation, Forensics and Chain of Custody
- Containment Strategies: Short-Term and Long-Term
- Making Containment Decisions
- Breach Notification and Regulatory Reporting
- External Communications: Customers, Media and Law Enforcement
- Eradication, Recovery and Return to Normal Operations
- Post-Incident Review and Root Cause Analysis
- Lessons Learned and Incident Trend Analysis
Containment Strategies: Short-Term and Long-Term
Stop the spread
Once an incident is confirmed, the first priority is usually containment: limiting how far it spreads and how much damage it does. Speed matters, but so does doing it in a way that keeps evidence and doesn’t cause more harm than the attack itself. “Incident containment methods” is a named CISM topic.
Short-term and long-term
| Short-term containment | Long-term containment | |
|---|---|---|
| Timing | Minutes to hours | Days to weeks |
| Purpose | Stop the bleeding | Hold the line while eradication is prepared |
| Examples | Isolate hosts with EDR; disable or reset compromised accounts; block malicious domains, IPs and senders; take an exposed service offline | Segment affected areas; temporary clean systems to keep the business running; extra monitoring; rotate credentials and keys |
Contain, but keep the evidence
- Do: isolate from the network, capture memory and running processes, keep a timeline, disable compromised accounts.
- Don’t: pull the power (memory evidence is lost), wipe and rebuild before evidence is taken, or talk to the media or the attacker unless authorised.
Containment by incident type
| Incident | Typical containment |
|---|---|
| Ransomware | Isolate hosts and segments; protect backups; disable accounts being used to spread |
| Compromised account | Disable or reset; revoke sessions and tokens; check MFA |
| Business email compromise | Remove forwarding rules; freeze pending payments |
| Data exfiltration | Block destinations; cut the access path; preserve logs |
| DDoS | Upstream filtering, scaling, rate limiting |
These are planned in playbooks, with pre-agreed authority, so they can be applied quickly.
Think a step ahead
- Scope first where possible, and contain all affected systems together.
- Expect the attacker to react: they may escalate or destroy data when they notice.
- Use out-of-band channels if they may be reading email.
- Keep business impact in view and involve system owners.
Example. Responders isolate one infected server, and within minutes the attacker triggers encryption on 40 others they already controlled. In the next exercise, the playbook adds a step: use EDR to identify every host with the attacker’s tools first, then isolate them all at once.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| First priority once an incident is confirmed | Contain it, preserving evidence |
| Why not wipe the system immediately? | It destroys evidence and root-cause clues |
| Better than pulling the power | Network isolation |
| Containing a compromised account | Disable or reset it; revoke sessions and tokens |
| Why plan containment in advance | Speed, with pre-agreed authority |
In short
- Incident containment methods are a named CISM topic; once an incident is confirmed, containment is usually the first priority.
- Short-term containment stops the spread fast: isolate hosts, disable accounts, block indicators, take exposed services offline.
- Long-term containment holds the line while eradication is prepared: segmentation, temporary clean systems, enhanced monitoring, credential rotation.
- Containment should preserve evidence: isolate rather than wipe; capture volatile data where possible.
- Containment strategies are planned in playbooks, with pre-agreed authority, so they can be applied quickly.
- Watch for attacker reactions: some escalate or destroy data when they notice containment.
Exam traps
- Wiping and rebuilding immediately destroys evidence and the chance to find the root cause.
- Pulling the power loses memory evidence; network isolation is often better.
- Containing only the first known system leaves others compromised.
- Containment without authority causes delays; agree authority in the plan.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Short-term and long-term
Contain, but keep the evidence
1 / 9