Containment Command Deck
Recall practical containment principles for ransomware response.
Principle What is the containment rule of thumb? Stop attacker reach while preserving the evidence needed to understand and eradicate. This is why isolate-and-preserve often beats reboot-and-hope. Two moves Reboot versus isolate Containment should reduce reach without unnecessarily erasing the story. Pressure line Operations says, "Leave the server online so production can finish the batch." The server is actively renaming shared files. Your line We need to isolate this server now to protect the rest of production; Operations can switch to the manual batch path while we preserve evidence. Letting active encryption continue because the current batch is important. It…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in