Containment
The incident response step focused on stopping an active breach from spreading further, before trying to fully remove its underlying cause.
Why containment comes before full cleanup
An incident that is still actively spreading, such as malware still executing or an attacker still holding an active session, will keep getting worse the longer full cleanup is delayed in favor of first stopping the immediate damage.
What containment can look like in practice
Isolating a compromised server from the network, revoking active sessions and credentials, or temporarily disabling a compromised service are all forms of containment, chosen based on what will stop the incident from progressing with the least disruption to unaffected systems.
Frequently asked questions
Does containment mean shutting the whole server down?
Not necessarily. A full shutdown is one option, but more targeted containment, like isolating network access or disabling one specific service, is often preferable when other parts of the server are unaffected.
What comes after containment?
Eradication, removing the underlying cause of the incident, followed by recovery, and finally verification that the fix actually worked, rather than just that the service is responding normally again.
Can containment itself cause downtime?
Sometimes, yes. Containment intentionally trades some availability for stopping further damage, which is usually the right trade during an active incident.
Want to see where your own server stands?
Run the free, read-only server check, or open the Security Lab and watch the detect, contain, recover, verify loop in action.
Get your free server checkOpen the Security Lab