Chapter 24 — Containment decisions under uncertainty | Bachelor's Incident response and cyber resilience

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 24 — Containment decisions under uncertainty

Lesson map

Lesson 24 published. Map, example, EX071.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["24.1 The decision problem"]
  N2["24.2 Reversibility and blast radius"]
  N3["24.3 Approval"]
  N4["24.4 Value of information"]
  N5["24.5 Sensitivity analysis"]
  N6["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX071"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["24.1 The decision problem"]
  N2["24.2 Reversibility and blast radius"]
  N3["24.3 Approval"]
  N4["24.4 Value of information"]
  N5["24.5 Sensitivity analysis"]
  N6["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX071"]

[Learning outcomes and connection]
    |
    v
[24.1 The decision problem]
    |
    v
[24.2 Reversibility and blast radius]
    |
    v
[24.3 Approval]
    |
    v
[24.4 Value of information]
    |
    v
[24.5 Sensitivity analysis]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX071]

Learning outcomes and connection

You will be able to (1) compare containment options by expected harm; (2) weigh reversibility and blast radius; (3) estimate the value of gathering more information before acting; and (4) test a decision with a sensitivity analysis. Chapter 23 produced a probability that an incident is real; this chapter turns probability and impact into action. Chapter 26 continues with recovery decisions.

24.1 The decision problem

Containment options trade harms: the harm the attacker could still cause, and the harm the containment itself causes (downtime, lost evidence, alerting the attacker). Doing nothing is also an option with consequences. A simple expected-harm comparison makes the trade-off explicit: for each option, expected harm = P(malicious) × harm if malicious under that option + harm of the option itself.

For svc-integration, the harm of disabling is concrete: lab results would stop reaching clinicians for about four hours. Writing that harm beside the harm an attacker could cause stops the discussion from treating containment as free. Monitoring only is listed as an option too, with its own expected harm, so that doing nothing is a visible choice rather than a default.

24.2 Reversibility and blast radius

Prefer reversible actions when uncertainty is high: revoking sessions can be undone (users sign in again); deleting a server cannot. The blast radius of containment is who else is affected: disabling a shared service account stops every service that uses it.

For svc-integration, the allow-list is reversible within minutes if it blocks a legitimate host, while disabling the account interrupts lab results for hours and cannot be undone for clinicians who missed results meanwhile. Blast radius here includes the billing export, because the account is shared. Knowing every consumer of a credential before acting is the practical lesson.

24.3 Approval

Containment of production systems requires the authority defined in advance (Chapter 21). The decision record names the decider, the options considered, the expected harms and the assumptions.

For the svc-integration decision, the record would name who approved the allow-list, the three options considered, the harm estimates agreed with the lab and billing owners, and the key assumption that the attacker does not control an allowed host. If that assumption later proves false, the record shows that the decision was reasonable on what was known and identifies exactly which belief changed. Without that record, the review after the incident tends to judge the decision by its outcome alone. Write the record during the decision, not from memory afterwards.

24.4 Value of information

If a quick check could change the decision, its expected value may justify a short delay. If no plausible result of the check would change the decision, act now. This is the decision-theoretic idea of the value of information.

In the svc-integration case, a 20-minute check could show whether the unknown host is a new integration server. Because the allow-list is cheap and reversible, the exercise answer is to apply it now and run the check in parallel; the check matters mainly for whether disabling becomes necessary. Delay pays only when waiting for information could change the action you are about to take.

24.5 Sensitivity analysis

Estimates of probability and harm are uncertain. Vary them across plausible ranges and see whether the preferred option changes. A decision that holds across the range is robust; one that flips at a plausible value needs either more information or a more reversible option.

In Lab 24 the probability barely matters: the allow-list wins at every value tested. What matters is its assumed residual harm, and the exercise that raises it from 20 to 70 shows the best option changing completely. Name that assumption in the decision record.

24.6 Worked example and lab (synthetic): a shared service account

Fictional. svc-integration is shared by the lab-results interface and the billing export. Evidence suggests its credential may have been used from an unknown host (P(malicious) ≈ 0.4). Options: - O1 Monitor only. - O2 Restrict the account to known source hosts (allow-list); breaks nothing if the list is right. - O3 Disable the account; stops lab results reaching clinicians for about 4 hours until a new credential is deployed.

Harms are in an arbitrary 0–100 scale agreed with the service owners (fictional). Save as lab24.py.

# Lab 24 - expected harm and sensitivity for three containment options (synthetic, stdlib only)
OPTIONS = {
    # name: (harm if malicious and this option is chosen, harm caused by the option itself)
    "O1 monitor":   (80, 0),
    "O2 allow-list": (20, 5),
    "O3 disable":   (5, 40),
}
def expected(p):
    return {k: round(p*hm + cost, 1) for k, (hm, cost) in OPTIONS.items()}

for p in (0.1, 0.2, 0.4, 0.7, 0.9):
    e = expected(p)
    best = min(e, key=e.get)
    print(f"p={p:.1f}", e, "->", best)

# when does disabling beat the allow-list?  p*20+5 = p*5+40  ->  p = 35/15
print("O3 beats O2 only if p >", round(35/15, 2), "(impossible: p <= 1)")

Expected output:

p=0.1 {'O1 monitor': 8.0, 'O2 allow-list': 7.0, 'O3 disable': 40.5} -> O2 allow-list
p=0.2 {'O1 monitor': 16.0, 'O2 allow-list': 9.0, 'O3 disable': 41.0} -> O2 allow-list
p=0.4 {'O1 monitor': 32.0, 'O2 allow-list': 13.0, 'O3 disable': 42.0} -> O2 allow-list
p=0.7 {'O1 monitor': 56.0, 'O2 allow-list': 19.0, 'O3 disable': 43.5} -> O2 allow-list
p=0.9 {'O1 monitor': 72.0, 'O2 allow-list': 23.0, 'O3 disable': 44.5} -> O2 allow-list
O3 beats O2 only if p > 2.33 (impossible: p <= 1)

Interpretation: under these harm estimates, the allow-list dominates across all probabilities. The conclusion is sensitive not to p but to the harm-if-malicious under O2, which assumes the allow-list stops the attacker. If the attacker controls an allowed host, O2's residual harm approaches O1's. EX071 asks you to test that. Monitoring (O1) is nearly tied with O2 only at low p; at p=0.1 the difference (8.0 vs 7.0) is smaller than the uncertainty in the estimates, which is a good reason to prefer the reversible, low-cost O2 anyway.

24.7 Common errors and limits

Treating containment as binary (disable or not).
Ignoring the harm caused by containment itself, especially to clinical or safety functions.
False precision: the harm scale is a structured judgement agreed with owners, not a measurement.
Forgetting that some actions alert the attacker; include that in harm if relevant.
Running the sensitivity analysis on the variable that is easy to vary rather than on the assumption the decision depends on.
Presenting expected-harm figures to owners without explaining that the scale is a judgement they helped set.

Exercises — chapter 24

Attempt each exercise before opening the worked results. Every case, organization, person, address and number in an exercise is synthetic unless a cited public source is named.

EX070 — Run and explain. Steps: run Lab 24 and explain to the service owner, in three sentences, why O2 is recommended. Rubric: 3 = plain language, mentions reversibility, clinical impact of O3 and the key assumption; 2 = misses assumption; 1 = jargon only; 0 = none.

EX071 — Break the assumption. Steps: change O2's harm-if-malicious from 20 to 70 (attacker on an allowed host) and report the new best option at each p. Rubric: 3 = correct table (O1 best at p ≤ 0.4, O3 best at p ≥ 0.7, O2 never best), thresholds computed; 2 = run without threshold; 1 = not run; 0 = none.

EX072 — Value of information. Inputs: a 20-minute check can determine whether the unknown host is a newly deployed integration server. Steps: argue whether to wait for it before O2. Rubric: 3 = O2 is cheap and reversible, so apply it now and run the check in parallel; the check matters mainly for whether O3 is needed; 2 = waits with reason; 1 = no reasoning; 0 = none.

Chapter synthesis

Compare options by expected harm including the harm of containment, prefer reversible actions under uncertainty, check the value of information, and run a sensitivity analysis on the assumption the decision depends on.

Continue studying — chapter 24 of 40

← Chapter 23 · Course chapter index · Chapter 25 →

Continue to the next authored lesson.