Incident Response Activities - Mitigation

The specifics of each attack will, to a large part, determine how different defensive capabilities contain the spread of an attack, isolate it to a limited set of systems or assets, and remove it from those systems.

Some typical containment tactics might include the following:

• Logically or physically disconnecting systems from the network or network segments from the rest of the infrastructure
• Disconnect key servers (logically or physically), such as Domain Name System (DNS), Dynamic Host Configuration Protocol (DHCP), or access control systems
• Disconnect your internal networks from your ISP at all points of presence
• Disabling Wi-Fi or other wireless and remote login and access
• Disabling outgoing and incoming connections to known services, applications, platforms, sites, or services
• Disabling outgoing and incoming connections to all external services, services, applications, platforms, sites, or services
• Disconnecting from any extranets or VPNs
• Disconnecting some or all external partners and user domains from any federated access to your systems
• Disable internal users, processes, or applications, either in functional or logical groups or by physical or network locations

A familiar term should come to mind as you read this list: quarantine. In general, that's what containment is all about. Suspect elements of your system are quarantined off from the rest of the system, which certainly can prevent damage from spreading.

It also can isolate a suspected causal agent, allowing you a somewhat safer environment in which to examine it, perhaps even identify it, and track down all of its pieces and parts.

As a result, containment and eradication often blur into each other as interrelated tasks rather than remain as distinctly different phases of activity.

Security controls benchmarks, frameworks, and mitigation sets are as useful during a post-incident mitigation phase as they are during preparation and systems hardening.

The incident may demonstrate elements of an attack pattern that align with exploits and controls highlighted by one of those frameworks, which may very well have reminders of real-time steps that can be taken to close that loophole in your cyber defenses.

For example, MITRE offers mitigation sets for both enterprise and mobile systems, which can be applied before, during, or after an incident as the case may require.

Eradication is the process of identifying and then removing every instance of the causal agent and its associated files, executables, and so forth from all elements of your system.

For example, a malware infection would require you to thoroughly scrub every CPU's memory, as well as all file storage systems (local and in thev clouds), to ensure you'd found and removed all copies of the malware and any associated files, data, or code fragments.

You'd also have to do this for all backup media for all of those systems in order to ensure you'd looked everywhere, removed the malware and its components, and clobbered or zeroized the space they were occupying in whatever storage media you found them on.

Depending on the nature of the causal agent, the incident, and the storage technologies involved, you may need to do a full low-level reformat of the media and completely initialize its directory structures to ensure that eradication has been successfully completed.