Containment

---

1. Short-Term Containment

Purpose: To quickly isolate impacted systems and prevent the spread of the incident while preserving evidence for forensic analysis.

• Why: Short-term containment limits the attacker's ability to move laterally or escalate privileges, buying time to develop a comprehensive remediation strategy.

---

Key Actions in Short-Term Containment

• Isolate Systems:

  • Place compromised systems in an isolated VLAN to restrict network access:

    vlan 99
    name Quarantine
    exit
    interface GigabitEthernet0/1
    switchport access vlan 99

  • Physically disconnect the system from the network by pulling the network cable (if feasible).

• Modify Attacker Infrastructure:

  • Redirect the attacker's Command-and-Control (C2) DNS name to a non-existent domain or a controlled sinkhole:

    echo "127.0.0.1 malicious-c2-domain.com" >> /etc/hosts

• Preserve Evidence:

  • Take forensic images of impacted systems before making significant changes:

    dd if=/dev/sda of=/mnt/external/evidence.img bs=4M
    sha256sum /mnt/external/evidence.img > evidence_hash.txt

• Minimize Footprint:

  • Avoid altering system state as much as possible to preserve forensic integrity:

    Document: "System isolated via VLAN change; no direct interaction performed."

• Coordinate with Stakeholders:

  • Communicate short-term actions to business units to minimize operational disruption:

    Notification: "SQLServer01 has been isolated for investigation. Expected downtime: 2 hours."

---

2. Long-Term Containment

Purpose: To implement persistent changes that address the root cause of the incident and prevent reoccurrence.

• Why: Long-term containment ensures that the environment is secured against the same attack vectors and prepares the organization for recovery.

---

Key Actions in Long-Term Containment

• Change User Passwords:

  • Reset credentials for compromised accounts and enforce strong password policies:

    Set-ADAccountPassword -Identity "User1" -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "NewP@ssw0rd!" -Force)

• Apply Firewall Rules:

  • Block malicious IPs or domains at the network perimeter:

    iptables -A INPUT -s 192.168.1.100 -j DROP

• Deploy Host Intrusion Detection Systems (HIDS):

  • Install and configure tools like OSSEC or Sysmon for enhanced monitoring:

    ossec-control start

• Apply Patches:

  • Patch vulnerabilities exploited by the attacker:

    sudo apt-get update && sudo apt-get upgrade

• Shut Down Systems:

  • Decommission systems that cannot be remediated or pose a high risk:

    sudo shutdown -h now

• Communicate with Stakeholders:

  • Keep stakeholders informed about long-term actions and their impact:

    Notification: "Firewall rules updated to block malicious IPs. No expected downtime."

---

3. Coordinated Execution

Purpose: To ensure containment actions are executed simultaneously across all impacted systems.

• Why: Uncoordinated actions may alert attackers, prompting them to change tactics or tools.

• Technical Example:

  • Use automation tools to execute containment actions across multiple systems:

    ansible-playbook -i inventory.yml containment_playbook.yml

  • Example Ansible Playbook (containment_playbook.yml):

    - hosts: all
      tasks:
        - name: Isolate systems in quarantine VLAN
          ios_config:
            lines:
              - switchport access vlan 99
            parents: interface GigabitEthernet0/1
    
        - name: Block malicious IPs on firewalls
          shell: iptables -A INPUT -s 192.168.1.100 -j DROP

---

4. Backup Substage

Purpose: To preserve forensic evidence during short-term containment.

• Why: Forensic images captured during this stage provide critical data for analysis and legal proceedings.

• Technical Example:

  • Create and verify forensic images:

    dd if=/dev/sda of=/mnt/external/evidence.img bs=4M
    sha256sum /mnt/external/evidence.img > evidence_hash.txt

  • Document the chain of custody:

    Evidence ID: Disk_Image_01
    Date/Time: 10/01/2023 15:00 CET
    Handler: John Smith
    Action: Created forensic image using dd.
    Hash: SHA256: abc123

---

5. Business Communication

Purpose: To ensure transparency and minimize operational disruptions during containment.

• Why: Clear communication helps maintain trust and ensures that business operations are not unnecessarily impacted.

• Technical Example:

  • Notify stakeholders through secure channels:

    echo "Notification: SQLServer01 has been isolated for investigation. Expected downtime: 2 hours." | mail -s "Incident Update" [e-mail]

---

Conclusion

Containment is a critical phase in incident response, divided into short-term and long-term actions. Short-term containment focuses on isolating systems and preserving evidence, while long-term containment addresses root causes and implements persistent changes. Coordinated execution ensures that containment actions do not alert attackers, and clear communication with stakeholders minimizes operational disruptions.

By following these practices, organizations can effectively contain incidents, protect critical assets, and prepare for subsequent eradication, recovery, and post-incident activities. Proper documentation and forensic preservation also ensure that evidence remains admissible for legal proceedings.