At 02:41 on a Saturday, with encryption launching from a domain controller, a clinic's incident commander had to decide how to stop it. The obvious move, cutting power to every server, would have stopped the encryption and also destroyed the evidence investigators needed to learn how the attacker got in. What the clinic did instead, and how it handled the ransom demand that followed, spans four of the exam's phases.
On the CompTIA Security+ SY0-801 exam, these phases sit under objective 4.7, which expects you to explain what happens in each stage of incident response. This lesson covers containment through quarantine and isolation, negotiation when attackers demand payment, eradication of every foothold, and recovery of normal operations.
Containment limits the damage without destroying the evidence
Containment stops an incident from getting worse: no more encryption, no more data leaving, no more movement to new systems. It doesn't fix anything. The attacker's tools and accounts are still present; they just can't reach anything new.
Containment balances speed against completeness. Contain too slowly and more systems are encrypted. Contain only what you can see, and the attacker keeps using a foothold you missed, now aware that you are responding. For ransomware that is actively encrypting, speed wins: responders isolate every affected host they can identify within minutes, then widen containment as the investigation finds more. For quieter intrusions, such as a slow data theft, teams sometimes keep watching until they have mapped every foothold, then cut them all off at once so the attacker can't fall back to one they missed.
Short-term containment is the immediate action, such as isolating a host. Long-term containment keeps the environment safe while eradication is prepared, such as running clinics on a separate, clean network segment while the VPN is rebuilt with MFA.
Quarantine and isolation can cover one host, one account or a whole site
Isolation, also called quarantine, cuts a system or account off from everything it could harm. The options differ in how much they cut off and how much evidence they keep.
| Method | What it does | Trade-off |
|---|---|---|
| EDR network containment | Blocks all host traffic except to the EDR console | Fast and remote; host keeps running; needs an agent |
| Switch port shutdown or quarantine VLAN | Removes the host from the production network | Works without an agent; may need hands on site |
| Firewall or ACL blocks | Stops traffic to attacker addresses or between segments | Cuts command-and-control and data theft; attackers can switch infrastructure |
| Disable accounts and revoke sessions | Takes away the attacker's credentials | Must cover every compromised account, including service accounts |
| Disconnect a site or the internet link | Isolates everything behind it | Very effective and very disruptive |
The clinic used most of them in its first half hour. Its action log:
02:44 EDR contain: FS01, DC01 and 23 workstations showing encryption (all left powered on)
02:51 Switch ports shut: PACS-ARCH01 and FAX01 (legacy servers, no EDR agent)
02:53 VPN: all remote access disabled except the IR group
02:55 AD: disabled svc_backup2 and the billing contractor account; passwords reset
02:58 EHR taken offline on the incident commander's authority; clinics to paper at opening
03:05 Firewall: outbound internet blocked from server VLANs except EDR and MSSP
With DC01 contained, the second domain controller kept authentication running, and the clinics opened on paper downtime procedures. Containment always costs the business something, which is why the incident commander had been given authority in advance to impose it. Note that disabling an account doesn't end sessions that are already open or tokens already issued, so those must be revoked as well, especially for cloud services.