Strengthening Your Incident Response with Effective Containment

Containment, Eradication, and Recovery is the third element of an effective Incident Response Plan. Let’s talk about Containment.

The strategies you choose to contain an ongoing security issue must be tailored to the specific type of incident your organization is facing. For example, the approach to containing a ransomware attack on critical systems differs significantly from that used for an insider threat trying to exfiltrate sensitive data.

Key Considerations for Containment Strategies:

Incident Type-Specific Strategies: Evaluate and document the types of security incidents that your organization may face. Then, identify the appropriate strategy to contain that type of incident. When developing a containment strategy, consider the following:
Impact on Data Availability: Assess how the containment strategy will affect the availability of critical information and services. You want to ensure that essential functions can continue with minimal disruption.
Resource Theft and Damage Prevention: Evaluate the potential for damage to systems and the risk of sensitive information being compromised. Implement measures to mitigate these risks.
Evidence Preservation: Ensure that the containment strategy does not compromise the integrity of evidence needed for forensic analysis and legal actions.
Long-Term Effectiveness: Determine whether the containment measures provide partial or full containment and whether they offer a temporary fix or a more permanent solution.
Duration and Sustainability: Evaluate the timeframe for which the containment measures need to be in place and ensure they can be maintained until a permanent solution is implemented.
Coordination with Recovery Efforts: Align the containment strategy with recovery plans. You want to make sure that actions taken during containment do not complicate the recovery process or make it take longer.
Monitoring Attacker Activity: In some cases, organizations may choose to redirect an attacker to a sandbox environment—a controlled setting where the attacker’s activities can be monitored without risk to the organization’s critical systems. Talk to your legal team before doing this, though.
Risk of Escalation: Be aware that containment actions can sometimes trigger additional harm. For example, disconnecting a compromised host from the network might cause a malicious process to react by overwriting or encrypting data on the host’s hard drive. This risk underscores the need for incident handlers to carefully consider the potential consequences of containment actions.
 

By thoughtfully developing and implementing tailored containment strategies, your organization can effectively limit the damage caused by security incidents and better protect your critical resources. These strategies should be part of your organization’s Incident Response Plan which is a necessary requirement for CMMC compliance. A failed audit can not only cause a company to lose contracts with the DoD and the income that comes with it; but it also can undermine a company’s efforts to create trust with their patrons and investors.