SANS Incident Handler's Handbook and PICERL Methodology
Phase 3: Containment – SANS Incident Handler's Handbook and PICERL Methodology

SANS Incident Handler's Handbook and PICERL Methodology C-1: C-1 Short-term containment: limit the damage fast, from isolating a segment to failing over to other servers

The first containment step limits damage as soon as possible, for example isolating the network segment of infected workstations, disconnecting cables or powering down switches or routers for affected parts of the network, or taking hacked production servers down and routing traffic to failover servers; it is not a long-term fix.

Maintained by Gerard BlokdykControl text last updated

Other controls in Phase 3: Containment – SANS Incident Handler's Handbook and PICERL Methodology

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll SANS Incident Handler's Handbook and PICERL Methodology controls