Contain Lateral Movement Without Erasing Evidence
Apply incident response principles to contain a suspected lateral movement event while preserving evidence and business continuity.
Finance subnet A finance workstation is touching six peers over SMB after midnight. Payroll runs soon, so the response must reduce attacker movement without destroying the evidence needed to scope the incident. Incident response Contain, preserve, coordinate, recover A strong response limits attacker options while keeping enough evidence to decide scope and recovery. panic rebuild Looks decisive but can erase scope evidence. The incident narrows instead of becoming guesswork. Response quality is measured by risk reduced and facts preserved. 01 First move 02 Scope 03 Recover Containment The workstation is live, connected, and still making SMB attempts.
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in