Cyberstudy
PDF p.302 In progress

Containment

Open PDF at p.302 17 flashcards

Summary

PDF p.302

Following detection and analysis, containment involves determining an appropriate response to an incident. This phase addresses various complex issues and employs techniques like isolation-based and segmentation-based containment to limit the impact of the incident.

In plain words

Supplementary — not from your PDF

Containment limits the damage. First weigh the damage already done, the countermeasures available, whether actions might alert the attacker, and what notifications are required. Isolation-based containment removes the component: unplug it or disable the port, isolate the VLAN, block with firewalls, disable accounts or apps. Segmentation-based containment keeps hosts in a controlled segment, sometimes using a sinkhole or honeynet to keep watching the attacker safely.

Detailed explanation

PDF p.302

Complex Issues in Containment

  • Damage Assessment: Determine the damage or theft already inflicted and potential future impact.
  • Countermeasures: Evaluate available countermeasures, their costs, and implications.
  • Alerting the Threat Actor: Consider actions that might alert the attacker and gather necessary evidence.
  • Notification: Identify required notifications or reporting at this stage.

Containment Techniques

Isolation-Based Containment

  • Definition: Removing an affected component from its larger environment.
  • Methods
    • Network Disconnection: Pulling the network plug or disabling the switch port (air gap).
    • VLAN Isolation: Using routing infrastructure to isolate infected VLANs.
    • Firewalls: Preventing infected hosts from communicating.
    • Account/Application Disabling: Disabling user accounts or application services to limit damage.

Segmentation-Based Containment

  • Definition: Isolating a host or group of hosts using network technologies.
  • Methods
    • VLANs, Subnets, and Firewalls: Preventing communication outside the protected segment.
    • Sinkhole/Honeynet: Allowing the attacker to receive filtered output to facilitate analysis and potentially identify the threat actor.

Important terms

taken from the text above
Damage Assessment
Determine the damage or theft already inflicted and potential future impact.
Countermeasures
Evaluate available countermeasures, their costs, and implications.
Alerting the Threat Actor
Consider actions that might alert the attacker and gather necessary evidence.
Notification
Identify required notifications or reporting at this stage.
Network Disconnection
Pulling the network plug or disabling the switch port (air gap).
VLAN Isolation
Using routing infrastructure to isolate infected VLANs.
Firewalls
Preventing infected hosts from communicating.
Account/Application Disabling
Disabling user accounts or application services to limit damage.
VLANs, Subnets, and Firewalls
Preventing communication outside the protected segment.
Sinkhole/Honeynet
Allowing the attacker to receive filtered output to facilitate analysis and potentially identify the threat actor.

Examples & real-world scenarios

Supplementary — not from your PDF
  • Disabling a compromised user account.
  • Moving infected hosts to an isolated VLAN.
  • Redirecting a malware's command traffic to a sinkhole.

Scenario

An analyst finds malware beaconing out. Pulling the plug stops it but may lose evidence and alert the attacker. The team first captures memory, then isolates the host by VLAN.

Common mistakes

Supplementary — not from your PDF
  • Acting before thinking about evidence and alerting the attacker.
  • Mixing up isolation (remove it) and segmentation (control it within a segment).

Practical skills

Supplementary — not from your PDF
  • Choose a containment technique for an incident.

What I should remember

Key Points PDF p.302
  • Complex Issues
    • Damage Assessment: Current and potential impact.
    • Countermeasures: Costs and implications.
    • Alerting the Threat Actor: Evidence gathering.
    • Notification: Required reporting.
  • Containment Techniques
    • Isolation-Based
      • Network Disconnection: Air gap.
      • VLAN Isolation: Routing infrastructure.
      • Firewalls: Communication prevention.
      • Account/Application Disabling: Limiting damage.
    • Segmentation-Based
      • Network Technologies: VLANs, subnets, firewalls.
      • Sinkhole/Honeynet: Deceptive analysis.