# Phase 3: Containment

Once an incident is identified and scoped, the immediate goal is to stop the bleeding. **Containment** is about preventing the attacker from doing any further damage or spreading to other systems.

## The Containment Dilemma
There are two main strategies for containment, and choosing the right one requires executive approval.

1.  **Immediate Containment (Pulling the Plug):**
    *   *Action:* As soon as a compromised machine is found, it is instantly disconnected from the network.
    *   *Pros:* Stops the attacker dead in their tracks. Prevents data exfiltration and ransomware encryption.
    *   *Cons:* Alerts the attacker that you know they are there. If you haven't fully scoped the incident, the attacker will immediately activate their dormant "Plan B" backdoors on other systems and bury themselves deeper. Furthermore, you lose Volatile Evidence (RAM) if the machine is powered off.
2.  **Delayed Containment (Monitoring):**
    *   *Action:* The defenders leave the compromised system online and silently watch the attacker.
    *   *Pros:* Allows defenders to fully understand the attacker's toolkit, discover all their backdoors, and fully scope the incident. Gives time to capture RAM and network packets.
    *   *Cons:* Highly risky. The attacker might suddenly decide to steal sensitive data or deploy ransomware while you are watching them.

## Containment Actions
If the decision is made to contain, the actions must be swift and comprehensive:
*   **Network Segmentation:** Moving infected hosts to an isolated Quarantine VLAN where they cannot talk to the internet or the rest of the corporate network.
*   **Firewall Blocks:** Blocking the known Command and Control (C2) IP addresses and domains at the perimeter firewall.
*   **Account Disablement:** Forcing password resets on compromised user accounts and disabling compromised service accounts.
*   **Endpoint Isolation:** Using EDR tools to logically cut the machine's network access, allowing it to *only* communicate with the IR team's forensic servers.