Back to Module
2 of 4|Incident Response
reading 15 min•Incident Management
Containment
Stopping the bleeding.
🎯 Learning Objectives
- ▸ Understand the containment phase
- ▸ Learn about short-term and long-term containment
The Containment Strategy
If you discover a hacker is in your database, you must kick them out. Containment involves:
- • Short-term: Isolate the affected server (take it offline).
- • Short-term: Block malicious IP addresses.
- • Long-term: Patch the vulnerability that allowed the breach.
- • Evidence: Do not wipe the server. Take a forensic image before rebuilding.
📖 Glossary
- Containment
- The process of limiting the scope and impact of a security incident.
- Forensic Image
- An exact copy of a storage device used for investigation purposes.
🔑 Key Takeaways
- Disconnect affected systems immediately.
- Change compromised passwords.
- Preserve evidence for the investigation.
📚 Further Reading
- NIST Incident Response Guide — NIST (2012)
Course Author
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...