Chapter 11 — Containment and communication
Lesson map
Lesson 11 published. Map, example, EX041.
flowchart TD
N0["Learning outcomes"]
N1["11.1 Options"]
N2["11.2 Proportion"]
N3["11.3 Approvals"]
N4["11.4 Talking to users"]
N5["11.5 Managers"]
N6["11.6 Data protection"]
N7["External partners"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX041"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["11.1 Options"]
N2["11.2 Proportion"]
N3["11.3 Approvals"]
N4["11.4 Talking to users"]
N5["11.5 Managers"]
N6["11.6 Data protection"]
N7["External partners"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX041"]
[Learning outcomes]
|
v
[11.1 Options]
|
v
[11.2 Proportion]
|
v
[11.3 Approvals]
|
v
[11.4 Talking to users]
|
v
[11.5 Managers]
|
v
[11.6 Data protection]
|
v
[External partners]
|
v
[Worked example] --> [Exercise EX041]
Learning outcomes
You will (1) choose containment actions proportionate to risk; (2) get the right approvals; (3) communicate with users, managers and partners; (4) avoid spreading alarm.
11.1 Options
Disable an account, reset a password, block an address, isolate a machine or remove an email. Each has a cost to the business. For parks01, the options were disabling the account, resetting its password, blocking 203.0.113.80 or isolating the depot tablet. Each stops a different part of the harm and costs something different: the gardeners lose their login, or a device stops working. Carlos chose by asking what the outsider was actually using. The playbook lists each option with who may approve it.
11.2 Proportion
Choose the smallest action that stops the harm. For parks01, disabling the account was enough; isolating the depot tablet was not needed because it was not involved. The outsider used only the parks01 account through the portal, so disabling it removed their access completely. Isolating the tablet would have stopped the gardeners working without affecting the outsider at all. Proportion keeps the council running while still stopping the harm. Carlos records why isolation was not used, so a reviewer sees it was considered.
11.3 Approvals
Northgate's playbook lets analysts disable accounts and block addresses alone; isolating servers needs the IT manager. These rules let Carlos act at 09:52 without waiting for anyone, because disabling an account is pre-approved. Isolating a server affects many users and services, so the IT manager decides. Knowing the boundary in advance avoids delays during an incident and prevents analysts overstepping. Any action outside these limits waits for approval, even during a busy incident. The approval is recorded in the incident record with its time.
11.4 Talking to users
The parks supervisor is told: "Your team's shared login was used by someone outside the council this morning. We have disabled it. IT will set up individual logins today." Plain words, no blame. The message tells the supervisor what happened, what was done and what comes next, without technical terms. It does not suggest that any gardener caused the problem by choosing a weak password. Saying 'IT will set up individual logins today' answers the supervisor's real concern, which is whether the team can keep working.
11.5 Managers
A short email to the head of IT and the information governance lead sets out facts, actions and next steps. Managers need enough to decide and to answer questions from above. For INC-0417 the email stated the outsider's logon, the six minutes of folder listing, the disabled account and the MFA plan. The information governance lead receives it because staff accounts and possible data were involved. The email goes out the same morning, after Aisha checks the wording for accuracy and tone.
11.6 Data protection
If personal data might have been exposed, the data protection officer must be told early; for parks01 no personal data was accessed. The share's audit log showed only folder listing, with no files opened or downloaded, which is why no personal data was considered accessed. Had the finance officer's account been used after her password was entered, the same check would apply to her mailbox. Telling the officer early leaves time for any legal deadlines. The data protection officer is still told about the finance officer's password case.
External partners
Sometimes containment involves others: the remote-access vendor, the internet provider or a national cyber centre. Northgate keeps a contact list with phone numbers and what each partner can do. In INC-0417, Carlos reports 203.0.113.80 to the national centre through its online form after Aisha's approval, adding the times and the type of activity seen. The centre may link it with reports from other councils and issue a warning, which is how the sharing system improves defences for everyone.
Worked example
The gardeners need to log timesheets by Friday. Carlos asks IT to create named accounts the same day, so the containment does not stop payroll for the parks team.
Synthetic case. Communications are invented.
Errors and limits
Over-containment can cause more harm than the attack; under-containment lets it continue.
Exercises
- EX041 — Proportion. Why was the tablet not isolated? Rubric: 3 = not involved; smallest action enough; 2 = partial; 1 = vague; 0 = none.
- EX042 — Approval rule. Which action needed the IT manager? Rubric: 3 = isolating servers; 2 = partial; 1 = vague; 0 = none.
- EX043 — User message. What made the supervisor message good? Rubric: 3 = plain, facts, action, no blame; 2 = partial; 1 = vague; 0 = none.
- EX044 — Business impact. How was payroll protected? Rubric: 3 = named accounts created same day; 2 = partial; 1 = vague; 0 = none.
Synthesis
Contain proportionately, with the right approval, and communicate plainly to everyone affected.
Continue studying — chapter 11 of 18
← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →