Home / Knowledge hub / Containment
Knowledge hub
Containment
Limiting an incident's spread first, before the clean-up starts.
What it means
Containment is the part of incident response where you stop the problem getting worse. Typical actions are isolating a machine from the network, disabling an account, revoking tokens or keys, blocking an address, or switching off one feature. Each one trades a little disruption for a smaller problem.
It comes before eradication and recovery. The aim is not to fix the root cause yet. It is to limit the damage while you work out what happened, in the way you would shut a door before you search the room.
Why it matters
Speed matters because attackers move on. A stolen credential used for ten minutes does less harm than the same credential used for ten days. The earlier you contain, the fewer systems, records and customers are involved, and the smaller the notification you may owe.
But containment is a set of trade-offs. NIST lists factors to weigh: potential damage, the need to preserve evidence, service availability, time and resources, and how long the measure will last. Cutting a payment service off may stop a theft and cost sales.
How it shows up
Short-term containment is the quick action: unplug the host, disable the account, rotate a leaked API key. Long-term containment keeps things stable while you prepare a clean rebuild, for example moving traffic to a patched copy. A playbook should name the actions and who may approve them.
Common mistakes are acting before saving evidence, tipping off an attacker who still has access elsewhere, and forgetting about copies of the same secret. Isolate rather than power off where you can, so memory is kept. Rotate every credential the intruder could have seen, not just the one you found.
Questions people ask
Containment, answered
What is the difference between containment and eradication?
Containment limits the spread. Eradication removes the cause: the malware, the backdoor, the vulnerable component.
If you eradicate before you contain, you may miss other footholds. If you contain and never eradicate, the problem returns.
Should we shut the system down?
Sometimes, if the harm is severe and growing. But shutdown loses memory data and can hide evidence, and it takes the service away from customers.
Network isolation often gives control with less loss.
Who can approve containment actions?
Decide in advance. A small number of named people, such as the on-call lead, should be able to act at once for defined actions, and escalate for larger ones such as taking down the product.
Waiting for a meeting costs hours.
How do we contain a leaked secret?
Revoke it and issue a new one, then check logs for use of the old one during the exposure window. Look for copies in code, config and chat.
Good secrets management makes this a short job.
How do we know containment worked?
Watch for the original behaviour to stop: no new connections, no new activity from the affected accounts. Keep monitoring for several days.
A quiet period is not proof. Confirm with logs, not with silence.
Sources
Where this comes from
Related
Terms that sit next to this one
Incident response
The agreed plan for the hours after something has gone wrong.
Incident playbook
A step-by-step guide for handling one type of incident the same way each time.
Lateral movement
Moving from the first thing reached to the things worth taking.
Secrets management
Keeping keys, passwords and tokens out of code and in a vault.
Security incident
An event that actually harms, or threatens to harm, your data or systems.
Could you cut off a bad key quickly?
We can show which secrets, tokens and routes a flaw exposes, with the request and response as proof, so you know what to rotate or close. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.