~/moritzsamrock_

Containment

Containment: Actions that limit the scopeScopeThe explicitly defined systems, data, locations, activities, and exclusions covered by an engagement., spread, and impactImpactThe consequence a security event or risk scenario would have for an organization or system. of an active security incident. Roles, decision authority, evidence, communication, and timing should be defined before an incident occurs.

How it works and where it fits

Containment belongs to a prepared workflow for handling security-relevant events. A technical signal becomes a substantiated incident only through triage, context, and assessment. Roles, decision authority, escalation paths, and stopping conditions should therefore be agreed in advance so actions remain consistent under time pressure.

Practical security relevance

Execution must balance rapid containment with careful evidence preservation. Actions should not unnecessarily destroy important traces or disrupt business operations without control. Timelines, decisions, and changes are documented; after recovery, root causes, identified gaps, and lessons learned feed back into controls, detection logic, and response plans.

  • Incident ResponseIncident ResponseA structured process for the preparation, detection, containment, eradication, and post-incident review regarding security incidents.: A structured process for the preparation, detection, containment, eradication, and post-incident review regarding security incidents.
  • IsolationIsolationThe separation of a system, process, or resource to limit access and prevent spread.: The separation of a system, process, or resource to limit access and prevent spread.
  • RecoveryRecoveryThe controlled restoration of systems, data, and business services after a disruption.: The controlled restoration of systems, data, and business services after a disruption.
  • QuarantineQuarantineIsolates suspicious files, messages, or devices from production resources.: Isolates suspicious files, messages, or devices from production resources.

Related terms