Containment Is a Systems Decision

Containment tries to limit ongoing harm or uncertainty.

The most aggressive option is not always the best option.

Turning everything off may destroy evidence, interrupt critical function, or create more harm than the incident itself.

Define the goal first

For the fictional role-change incident, a containment goal could be:

Prevent Alice's current sessions from performing privileged actions while preserving public status viewing and legitimate coach administration.

That is much more useful than:

Stop the incident.

Compare options

Option A: disable Alice account completely

Benefits:

• broad stop on represented account activity.

Costs:

• may interrupt legitimate viewer function;
• does not explain how privilege changed;
• may not address other affected accounts.

Option B: remove admin role + revoke active sessions

Benefits:

• directly addresses represented excessive privilege;
• preserves ability to restore normal viewer access after reauthentication.

Costs:

• depends on role/session control functioning correctly;
• may be insufficient if root cause exists elsewhere.

Option C: monitor only

Benefits:

• preserves system state/evidence.

Costs:

• leaves represented privileged authority active.

Given the supplied evidence of a privileged action, monitoring only is difficult to justify unless stronger operational constraints exist.

Containment should preserve evidence when practical

Before changing role/session state, record:

• current role mapping;
• active synthetic session IDs;
• recent privileged actions;
• relevant change/audit events;
• approval record state.

Then make the authorized containment change.

Use decision criteria

A containment decision can consider:

• ongoing harm potential;
• confidence in affected scope;
• critical business/school function;
• evidence preservation;
• reversibility;
• time to implement;
• possibility of causing new failure;
• authority/approval.

The chosen option should reference those criteria.

Supplied containment action

Authorized decision:

remove alice admin role
revoke Alice's active privileged sessions
retain account as viewer after controlled reauthentication

Evidence:

16:12 role_change alice admin→viewer approver=coach incident=INC-016
16:12 session_revoke account=alice count=2 incident=INC-016
16:14 action alice update_match_note decision=deny role=viewer
16:15 action alice read_status decision=allow

This is a strong containment retest in the fictional model:

• privileged action denied;
• legitimate viewer action preserved.

Containment is not eradication or recovery

The system may still have the condition that allowed the unexplained role change.

Containment says:

we reduced the immediate represented authority/path.

It does not say:

root cause is solved.

Keep phases conceptually separate even if real teams overlap them.

Communication is part of incident control

A useful status update contains:

• what is known;
• what is not known;
• impact/affected function;
• action taken;
• evidence preserved;
• next decision point;
• owner/time for next update.

Avoid speculative blame.

Example:

We confirmed an unplanned admin-role assignment and one privileged configuration export in the fictional system. The account has been returned to viewer, active sessions revoked, and public status service remains operational. We have not established how the role change occurred. Identity/change logs are preserved and the next step is to review the approval workflow and other role changes in the represented window.

Activity: choose containment for three scenarios

1. log forwarder drops events but application is healthy;
2. backup restore test fails but production-like data is intact;
3. privileged role unexpectedly granted and used.

For each, choose among:

• isolate/disable;
• narrow authority;
• fail over/recover;
• monitor with compensating control;
• stop change and preserve state;
• another defensible option.

Explain the mission tradeoff.

Extend your Incident Decision and Recovery Record

Add:

containment goal
options considered
decision criteria
chosen action
authority/approver
evidence preserved before change
positive function retest
negative containment retest
status update

Lesson 3 moves from containment to recovery and learning.