Containment - NIST 800-61 Incident Response Phase

Containment is the NIST SP 800-61 incident response phase in which the adversary's ability to expand the compromise, exfiltrate additional data, or cause further harm is blocked. Containment is the response action immediately after detection and analysis, and precedes eradication and recovery. The containment phase typically distinguishes between short-term containment (stopping the bleeding) and long-term containment (preventing re-entry while eradication proceeds).

Short-Term vs Long-Term Containment

Short-term containment is the initial action to limit damage: isolating an infected host from the network, disabling a compromised account, blocking outbound traffic to a known C2 domain. It buys time but is not the final answer.

Long-term containment is the more comprehensive containment strategy applied while eradication proceeds: temporary segmentation, additional monitoring, application of patches and configuration changes, and additional preventive controls. Long-term containment can last days or weeks.

Containment Strategies

• Network isolation: VLAN moves, firewall rules, EDR isolation actions
• Account containment: password resets, MFA enforcement, session termination, conditional access policies
• System containment: process termination, service restart, host quarantine, full power-off
• Application containment: WAF rules, rate limiting, feature flag toggles
• Data containment: blocking outbound exfiltration, DLP rules, S3 bucket policy changes

Common Containment Mistakes

The most common mistakes are jumping to eradication before scoping the compromise (which leaves backdoors), aggressive containment that alerts the adversary (who then accelerates exfiltration or destruction), and containment without parallel forensic preservation (which loses evidence). NIST 800-61 explicitly calls for evidence preservation during containment.