{"id":1758,"date":"2019-07-13T12:37:16","date_gmt":"2019-07-13T11:37:16","guid":{"rendered":"http:\/\/www.halkynconsulting.co.uk\/a\/?p=1758"},"modified":"2020-08-03T14:32:23","modified_gmt":"2020-08-03T13:32:23","slug":"incident-response-containment","status":"publish","type":"post","link":"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/","title":{"rendered":"Incident Response Phases \u2013 Containment"},"content":{"rendered":"

In a previous post<\/a> we discussed Incident Response (IR) processes and our preference is one that runs Preparation, Identification, Containment, Eradication, Recovery and Lessons Learned (PICERL). In this post, we are going to be looking a bit more into the Containment phase of IR.<\/p>\n

\"Incident
PICERL – Common incident response process \/ framework<\/figcaption><\/figure>\n

You have identified an event. Then you confirmed it was an incident. So now you need to look at containment. This is where your IR team start to earn their pay. But there are some pitfalls – most importantly do not rush! Also, there are times you may even want to skip this step entirely. All of this should be decided in your preparation phase.<\/p>\n

Containment<\/h2>\n

Simply, containment means stopping the attack spreading. Now, in practice, this can be complex but the theory is simple. Because incidents are varied try to avoid setting prescriptive plans. Instead, empower your IR team to make tactical decisions. <\/p>\n

Keep in mind this is a short term strategy. You are trying to seize the initiative from the attacker. A common model here is the OODA-loop<\/a>. Here you are trying to change the cadence so you no longer constantly react to the attacker. Good strategy here turns the tables and forces the attacker to react to your actions. Ultimately this means your containment strategy decides how successful your IR will be.<\/p>\n

Warning!<\/h3>\n

First a quick warning. Never – ever – rush into containment<\/strong>. It is tempting and natural, to want to pull cables or shut systems down when you see an attack. But this can be a mistake. Rarely will this turn out to be a “good” strategy. More often you will undermine the IR process, destroy evidence and warn the attacker. Ultimately the decision should be taken by the Incident Manager, so your Plan needs to support them. However, you also need to remember that during the stress of IR, don’t add to it by panicking about containment.<\/p>\n

One point to remember: as a human, you can never react as fast as a computer. This means waiting a bit longer is unlikely to make things significantly worse.<\/p>\n

Containment Guidance<\/h3>\n

So, with the warning out of the way, how do we do this?<\/p>\n

Unfortunately, there is no one-size-fits-all answer. In essence, it is simply “do good IR.” Because that isn’t helpful, there are some steps to consider.<\/p>\n

Investigation<\/h4>\n

Begin by finding out as much as possible. Gather information about the incident. Then analyse it as much as you need<\/em>. This is important – too much delays things, too little leads to mistakes. This can be more art than science, but experience improves things. Your incident manager should try to focus the investigation to minimise spurious activity. <\/p>\n

As investigators find things, this “intelligence” should be fed back to the Incident Management Team to make decisions. Another important point here is to try to reduce noise. Lots of information will appear, avoid being distracted by irrelevant data or information you cant act on.<\/p>\n

Action<\/h4>\n

Next, take the information and turn it into action. This is the primary role of the incident manager. As investigators provide more data, a containment strategy is likely to emerge. In turn, the manager should use this to direct investigators. Through this iterative process, a robust strategy will be formed.<\/p>\n

Some examples include:<\/p>\n

    \n
  • Create an incident response VLAN. Move infected machines into it. This allows monitoring\/response but prevents further spread or C2.<\/li>\n
  • Locking compromised user accounts. This prevents an attacker from continuing to use them to get access.<\/li>\n
  • Blocking external access to vulnerable websites. This prevent an attacker from using webshells.<\/li>\n<\/ul>\n

    Remember all this carries risk. Your actions are likely to alert the attacker. If they have other ways in, you might lose visibility. Only act based on your investigation.<\/p>\n

    Skip it<\/h3>\n

    Occasionally you might decide to skip this phase. Yes, this is shocking! But remember, none of this is prescriptive. <\/p>\n

    Containment works best with low-skilled attackers. If you have an advanced adversary, you might only alert them. As a result, waiting until you can eradicate may be better. You can give guidance here in your Plans. However, the final decision should be based on the investigation. <\/p>\n

    Stopping the spread<\/h2>\n

    In summary, this is the goal of containment. You need to try and prevent things from getting worse. Let your risk appetite guide decisions. Investigate well and build a robust strategy. When you are ready to implement, be decisive. <\/p>\n","protected":false},"excerpt":{"rendered":"

    Containment is the third phase of the IR Cycle. You investigate what happened and implement measures to stop the attack spreading or doing more harm than you are prepared to accept.<\/p>\n","protected":false},"author":1,"featured_media":1730,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"footnotes":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true},"categories":[5],"tags":[175,159,151,137,173],"class_list":["post-1758","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-containment","tag-cyber-security","tag-dfir","tag-incident-response","tag-picerl","entry","has-media"],"jetpack_publicize_connections":[],"yoast_head":"\nIncident Response Phases \u2013 Containment - Halkyn Security Blog<\/title>\n<meta name=\"description\" content=\"Containment is the third phase of the IR Cycle and is about preventing an attack spreading or doing more harm than you can tolerate.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Incident Response Phases \u2013 Containment - Halkyn Security Blog\" \/>\n<meta property=\"og:description\" content=\"Containment is the third phase of the IR Cycle and is about preventing an attack spreading or doing more harm than you can tolerate.\" \/>\n<meta property=\"og:url\" content=\"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/\" \/>\n<meta property=\"og:site_name\" content=\"Halkyn Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2019-07-13T11:37:16+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-08-03T13:32:23+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2019\/04\/PICERL.png?fit=719%2C718&ssl=1\" \/>\n\t<meta property=\"og:image:width\" content=\"719\" \/>\n\t<meta property=\"og:image:height\" content=\"718\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Halkyn Security\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2019\/04\/PICERL.png?fit=719%2C718&ssl=1\" \/>\n<meta name=\"twitter:creator\" content=\"@HalkynSecurity\" \/>\n<meta name=\"twitter:site\" content=\"@HalkynSecurity\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Halkyn Security\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/#article\",\"isPartOf\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/\"},\"author\":{\"name\":\"Halkyn Security\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/3cfcd2267f12bbcce6a10159022c3df2\"},\"headline\":\"Incident Response Phases \u2013 Containment\",\"datePublished\":\"2019-07-13T11:37:16+00:00\",\"dateModified\":\"2020-08-03T13:32:23+00:00\",\"mainEntityOfPage\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/\"},\"wordCount\":750,\"commentCount\":0,\"publisher\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#organization\"},\"keywords\":[\"Containment\",\"Cyber Security\",\"DFIR\",\"Incident Response\",\"PICERL\"],\"articleSection\":[\"Security\"],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/\",\"url\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/\",\"name\":\"Incident Response Phases \u2013 Containment - Halkyn Security Blog\",\"isPartOf\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#website\"},\"datePublished\":\"2019-07-13T11:37:16+00:00\",\"dateModified\":\"2020-08-03T13:32:23+00:00\",\"description\":\"Containment is the third phase of the IR Cycle and is about preventing an attack spreading or doing more harm than you can tolerate.\",\"breadcrumb\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Halkyn Security\",\"item\":\"http:\/\/www.halkynconsulting.co.uk\/a\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security\",\"item\":\"http:\/\/www.halkynconsulting.co.uk\/a\/category\/security\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Incident Response Phases \u2013 Containment\"}]},{\"@type\":\"WebSite\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#website\",\"url\":\"http:\/\/www.halkynconsulting.co.uk\/a\/\",\"name\":\"Halkyn Security Blog\",\"description\":\"Specialist Security & Risk Management Consultants\",\"publisher\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"http:\/\/www.halkynconsulting.co.uk\/a\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#organization\",\"name\":\"Halkyn Consulting\",\"url\":\"http:\/\/www.halkynconsulting.co.uk\/a\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2011\/07\/Untitled-1.png?fit=990%2C170&ssl=1\",\"contentUrl\":\"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2011\/07\/Untitled-1.png?fit=990%2C170&ssl=1\",\"width\":\"990\",\"height\":\"170\",\"caption\":\"Halkyn Consulting\"},\"image\":{\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/2329571\",\"https:\/\/twitter.com\/HalkynSecurity\"]},{\"@type\":\"Person\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/3cfcd2267f12bbcce6a10159022c3df2\",\"name\":\"Halkyn Security\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4126abc936773e5e8bd38e030d54306e161190a7d6166dba7edadb6caf13b504?s=96&d=retro&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4126abc936773e5e8bd38e030d54306e161190a7d6166dba7edadb6caf13b504?s=96&d=retro&r=g\",\"caption\":\"Halkyn Security\"},\"description\":\"Halkyn Security Consultants.\",\"sameAs\":[\"http:\/\/www.halkynconsulting.co.uk\/\"],\"url\":\"http:\/\/www.halkynconsulting.co.uk\/a\/author\/halkyn-consulting\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Incident Response Phases \u2013 Containment - Halkyn Security Blog","description":"Containment is the third phase of the IR Cycle and is about preventing an attack spreading or doing more harm than you can tolerate.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/","og_locale":"en_GB","og_type":"article","og_title":"Incident Response Phases \u2013 Containment - Halkyn Security Blog","og_description":"Containment is the third phase of the IR Cycle and is about preventing an attack spreading or doing more harm than you can tolerate.","og_url":"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/","og_site_name":"Halkyn Security Blog","article_published_time":"2019-07-13T11:37:16+00:00","article_modified_time":"2020-08-03T13:32:23+00:00","og_image":[{"width":719,"height":718,"url":"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2019\/04\/PICERL.png?fit=719%2C718&ssl=1","type":"image\/png"}],"author":"Halkyn Security","twitter_card":"summary_large_image","twitter_image":"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2019\/04\/PICERL.png?fit=719%2C718&ssl=1","twitter_creator":"@HalkynSecurity","twitter_site":"@HalkynSecurity","twitter_misc":{"Written by":"Halkyn Security","Estimated reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/#article","isPartOf":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/"},"author":{"name":"Halkyn Security","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/3cfcd2267f12bbcce6a10159022c3df2"},"headline":"Incident Response Phases \u2013 Containment","datePublished":"2019-07-13T11:37:16+00:00","dateModified":"2020-08-03T13:32:23+00:00","mainEntityOfPage":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/"},"wordCount":750,"commentCount":0,"publisher":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#organization"},"keywords":["Containment","Cyber Security","DFIR","Incident Response","PICERL"],"articleSection":["Security"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/#respond"]}]},{"@type":"WebPage","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/","url":"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/","name":"Incident Response Phases \u2013 Containment - Halkyn Security Blog","isPartOf":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#website"},"datePublished":"2019-07-13T11:37:16+00:00","dateModified":"2020-08-03T13:32:23+00:00","description":"Containment is the third phase of the IR Cycle and is about preventing an attack spreading or doing more harm than you can tolerate.","breadcrumb":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/"]}]},{"@type":"BreadcrumbList","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/2019\/07\/incident-response-containment\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Halkyn Security","item":"http:\/\/www.halkynconsulting.co.uk\/a\/"},{"@type":"ListItem","position":2,"name":"Security","item":"http:\/\/www.halkynconsulting.co.uk\/a\/category\/security\/"},{"@type":"ListItem","position":3,"name":"Incident Response Phases \u2013 Containment"}]},{"@type":"WebSite","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#website","url":"http:\/\/www.halkynconsulting.co.uk\/a\/","name":"Halkyn Security Blog","description":"Specialist Security & Risk Management Consultants","publisher":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"http:\/\/www.halkynconsulting.co.uk\/a\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#organization","name":"Halkyn Consulting","url":"http:\/\/www.halkynconsulting.co.uk\/a\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/logo\/image\/","url":"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2011\/07\/Untitled-1.png?fit=990%2C170&ssl=1","contentUrl":"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2011\/07\/Untitled-1.png?fit=990%2C170&ssl=1","width":"990","height":"170","caption":"Halkyn Consulting"},"image":{"@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/2329571","https:\/\/twitter.com\/HalkynSecurity"]},{"@type":"Person","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/3cfcd2267f12bbcce6a10159022c3df2","name":"Halkyn Security","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"http:\/\/www.halkynconsulting.co.uk\/a\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4126abc936773e5e8bd38e030d54306e161190a7d6166dba7edadb6caf13b504?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4126abc936773e5e8bd38e030d54306e161190a7d6166dba7edadb6caf13b504?s=96&d=retro&r=g","caption":"Halkyn Security"},"description":"Halkyn Security Consultants.","sameAs":["http:\/\/www.halkynconsulting.co.uk\/"],"url":"http:\/\/www.halkynconsulting.co.uk\/a\/author\/halkyn-consulting\/"}]}},"jetpack_featured_media_url":"https:\/\/i0.wp.com\/www.halkynconsulting.co.uk\/a\/wp-content\/uploads\/2019\/04\/PICERL.png?fit=719%2C718&ssl=1","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p9yHvD-sm","jetpack_likes_enabled":false,"_links":{"self":[{"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/posts\/1758","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/comments?post=1758"}],"version-history":[{"count":5,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/posts\/1758\/revisions"}],"predecessor-version":[{"id":1773,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/posts\/1758\/revisions\/1773"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/media\/1730"}],"wp:attachment":[{"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/media?parent=1758"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/categories?post=1758"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.halkynconsulting.co.uk\/a\/wp-json\/wp\/v2\/tags?post=1758"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}