- [Narrator] As the full incident response team assembles
they move from the isolation and quarantine strategy
used by first responders
into a full incident mitigation mode.
The goal of this mitigation phase
is controlling the damage and loss
caused to the organization
by performing a full range
of incident containment activities.
The nature of those activities
will vary based upon the severity of the incident.
The National Institute for Standards and Technology
suggests six criteria that responders may use
when evaluating a potential containment strategy.
First, responders should consider
the potential for damage and theft
of resources during the incident.
Second, they should evaluate the need
for evidence preservation and the effect
that the strategy might have
on the ability to preserve evidence.
Third, responders should evaluate
service availability requirements
and the impact of different containment strategies
on that service availability.
Fourth, responders must understand
the time and resources required
to implement any proposed containment strategy.
Fifth, responders should understand
the expected effectiveness of the strategy.
Will an approach fully contain the incident?
Or is it likely only a partial fix?
And finally, responders must understand the length of time
that the solution will remain in place.
Organizations can use these criteria
to help choose between different containment strategies.
The goal is to select a containment strategy
that balances the business needs of the organization
with the security objectives of incident response.
This is a tricky balance to strike.
And there are no certain answers.
Incident responders will always need to use
their best judgment and when possible,
seek input from management and other stakeholders.
Once an organization begins implementing
containment actions, responders must keep in mind
that the attacker will likely detect those actions
and know that the investigators are hot on their trail.
This may cause the attacker to speed up activities,
destroy evidence or perform other actions
that are detrimental to the incident response
or the organization's business.
At the end of the containment process,
the organization should be in a semi-stable state.
Responders should be confident that the incident is over
and there is no immediate danger to the organization.
Business operation should be functioning
at least on a limited basis.
Although they may be using temporary work arounds.
Everything is generally okay and the organization
is ready to move on to the next step of the process.
Recovery and reconstitution.