What is Containment?

Containment splits into short-term and long-term phases. Short-term containment prioritizes immediate damage limitation: isolating a compromised workstation (leaving it running for forensics), blocking malicious IPs at the firewall, disabling compromised accounts. These actions stop immediate damage while scope is assessed.

Long-term containment implements sustainable controls during remediation preparation: moving compromised systems to isolated VLANs, adding monitoring on affected segments, applying emergency patches, temporarily disabling affected services if risk warrants it.

Containment decisions balance security against operational continuity. Complete isolation may shut down critical business services. Over-containment causes significant disruption. Under-containment allows the attacker to continue. Evidence preservation must be considered, as some containment actions, such as wiping a system, destroy evidence needed for investigation.

Common containment mechanisms an analyst executes directly: EDR network isolation (the agent blocks all network traffic except its own management channel to the console, so the host is unreachable to an attacker but still analyzable), disabling a compromised Active Directory account and forcing a password reset, revoking active sessions and OAuth tokens so a stolen credential or token cannot be reused even after the password changes, and adding a firewall or proxy block for known attacker IPs and domains observed in the incident.

A ransomware scenario illustrates the short-term versus long-term split concretely: short-term containment might isolate the hosts actively encrypting files and disable the compromised service account being used to spread, within minutes, to stop the bleeding. Long-term containment, over the following hours, involves reviewing backup integrity, segmenting the affected subnet from the rest of the network, and disabling SMB where it is not required, since many ransomware families spread that way.

Containment scope decisions also depend on how confident the team is in its visibility. If the attacker's full footprint is unknown, teams sometimes contain more broadly than the confirmed compromise, isolating an entire VLAN rather than one host, to avoid missing an unseen pivot point, accepting the operational cost of over-containment against the risk of a contained attacker re-emerging from an unnoticed foothold.