Containment without destroying evidence
🎯You'll be able to
Choose containment steps that stop the harm while keeping the evidence needed to understand what happened.
🏠The everyday picture
After a break-in at a shop, the owner locks the door and calls the police, but doesn't sweep the floor first. The footprints are evidence.
📘What it really is
-
Short-term containment stops the harm now: disable the account, end its sessions, block the source address, or take a server off the network.
-
Preserve before changing: copy relevant logs, take snapshots of affected systems, and record their hashes (CY8), before cleaning anything.
-
Isolate rather than power off, where possible. Switching a machine off loses what's in memory, such as running programs and network connections.
-
Think about the order: if the intruder may hold several ways in, removing one can warn them while the others stay open. The incident lead decides, with what's known.
-
Long-term containment keeps the business running safely while the full fix is prepared, for example a temporary clean server.
- Write down every step and its time in the log.
📝A worked example
Input: the S04 incident, confirmed and rated high.
Steps:
- Copy
auth.jsonlandweb.jsonlto a safe place and record their SHA-256 hashes. - Disable S04, end all of S04's sessions, and remove the admin role S04 granted itself.
- Block
203.0.113.77at the firewall, and check whether any other account logged in from it.
Expected output: harm stopped, evidence copied with hashes, and every step logged with times.
🌍Where it's used
- Cloud incident teams snapshot a disk before isolating a server.
- Email providers suspend compromised accounts and end their sessions.
- Ransomware response isolates infected machines from the network quickly.
📝Case scenario
An IT contractor found malware on a clinic's server and reinstalled it the same afternoon. The clinic then couldn't tell whether patient records had been taken, so it had to treat every record as possibly exposed. A disk snapshot first would have taken an hour.
🖱️Try it
For "a staff laptop shows signs of malware", write three containment steps in the right order. Success: evidence is preserved before anything is wiped, and the laptop is isolated rather than switched off.
⚠️Common mistakes
- Wiping first. Sign: rebuilt servers and no copies. Fix: preserve, then clean.
- Disabling the account but not its sessions. Sign: the old cookie still works. Fix: end sessions too.
- Forgetting other access. Sign: one account disabled, the same address still logged in elsewhere. Fix: search for related activity.
🛠️For your project
The playbook's containment section lists these steps for AarogyaDesk, in order, with who does each.
✅Quick check
Why isolate a machine instead of switching it off, where possible?
Show the answer
Switching off loses what's in memory, which can be important evidence.
What should happen before any cleaning starts?
Show the answer
Copies of logs and snapshots, with their hashes recorded.