~/moritzsamrock_

Kill Switch

Kill Switch: Mechanism for immediately interrupting a service, process, or attack path. The focus is on resilience and recoveryRecoveryThe controlled restoration of systems, data, and business services after a disruption. following disruptions. This encompasses prioritized business processes, tested plans, robust backups, drills, and clearly defined recovery objectivesRecovery ObjectiveA measurable target for the timing or data state of recovery after a disruption..

How it works and where it fits

Kill Switch belongs to a prepared workflow for handling security-relevant events. A technical signal becomes a substantiated incident only through triage, context, and assessment. Roles, decision authority, escalation paths, and stopping conditions should therefore be agreed in advance so actions remain consistent under time pressure.

Practical security relevance

Execution must balance rapid containment with careful evidence preservation. Actions should not unnecessarily destroy important traces or disrupt business operations without control. Timelines, decisions, and changes are documented; after recovery, root causes, identified gaps, and lessons learned feed back into controls, detection logic, and response plans.

  • Incident ResponseIncident ResponseA structured process for the preparation, detection, containment, eradication, and post-incident review regarding security incidents.: A structured process for the preparation, detection, containment, eradication, and post-incident review regarding security incidents.
  • QuarantineQuarantineIsolates suspicious files, messages, or devices from production resources.: Isolates suspicious files, messages, or devices from production resources.
  • RansomwareRansomwareMalware that encrypts data or locks systems and demands a ransom.: Malware that encrypts data or locks systems and demands a ransom.
  • Command and ControlCommand and ControlCommunication infrastructure used by attackers to control compromised systems.: Communication infrastructure used by attackers to control compromised systems.

Related terms