Incident Response Lifecycle Contain

00:04

okay, the next step in our life cycle processes we want to contain. And by that we want to make sure that this activity, whatever the source of the incident is, doesn't spread to other computers that are currently unaffected. All right, so when we talk about containing

00:21

we look for two steps, we want a triage and then we wanna isolate.

00:26

So when we talk about triage, we want to get a good understanding of what's going on. There might be multiple incidents happening or multiple scenarios playing out in front of us. So when we talk about triage, we're going in. And we're trying to figure out which the incidents are,

00:43

Uh, which of the events or activities

00:47

is the most severe, which is causing the greatest damage so ultimately were shorting. We're categorizing. And essentially we're prioritising the various events that are going on so that we can direct our efforts at those events causing the greatest damage.

01:06

And again, that kind of goes back to criticality so you can think about triage

01:11

as shorting the ongoing events based on their credit count. Again, we're looking to direct your attention to those areas where we suffer the greatest loss first. OK, so we take what we know and then we prioritise. Er it doesn't mean that we know everything. We're not spending all our time here,

01:30

but we're trying to get a quick understanding of where we need to direct our efforts first

01:34

and again. It's all about criticality

01:38

prioritizing based on criticality. That's triage. Now, once we triage and we have a sense of where we're going to direct our efforts and where we have potentially have the greatest balls, we wanna isolate those affected systems and try to keep them away from the rest of the network and the rest of the environment.

01:57

Now, I want to be very careful here because we want to isolate the infected system. We want to ideally protect the rest of the network. But their steps that we have to take when we do us like this system, especially if we're looking to collect evidence in such a manner that was being permissible in court or admissible in court.

02:19

So we don't want to just run around unplugging computer systems.

02:23

Certainly that will limit the amount of damage on that system that will stop the network based attack. But it will also erase all the evidence that's in RAM. That might be in registers or cash or whatever that may be

02:36

again. This is why preparation is so very important that we have the procedures outlined, step by step, what is acceptable to do and what is not.

02:46

You know, usually, when we talk about isolating system, we're talking about pulling it off the network, not unplugging but pulling not power and down the system, but pulling the network cable, isolating it. If it's a set a segment, it's a group of computers isolating that computer or those computers.

03:07

Maybe unplugging that segment from the router or the V lan,