Separate evidence preservation from containment reflex
Explain when immediate containment can conflict with evidence preservation and how responders balance the two.
Containment reduces harm. Evidence preservation protects judgment. Responders often collapse those into one action, especially under pressure. That is how useful evidence disappears. If a host is beaconing, your first impulse may be to power it off or reimage it. But on many systems the most useful scoping clues are volatile: RAM artifacts, running processes, loaded modules, network sockets, temporary credentials, and active remote sessions. The better question is: what is the smallest action that lowers risk while keeping decision-quality evidence alive? Network isolation, session revocation, snapshotting, memory capture, or disabling one compromised identity can buy time without erasing the…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in