Data Breach Preparation and Response

Chapter 5

Containing a Breach

Chris Pogue

Abstract

This chapter covers the steps an organization should take to contain a Breach.

Keywords

Breach containment; Window of compromise; Window of intrusion; Breach breakdown

Contents

Introduction

Breach Containment

What Are You Containing?

Remediating Your Exposures

Are There More of You?

Removing Posted Information From the Internet

Containing Compromised Systems

Shutting Systems Down

Removing Systems From the Network

Patching Systems

Rebuilding Systems

Summary

Introduction

OK, so … now what? At this phase of the Breach, you are more than likely past the worst of it. I say, “more than likely” due to the fact that many Breach investigators make the mistake of myopically focusing on the Breach ...