Containment actions

What are appropriate actions?

We will examine scenarios for common actions and see what the positive and negative impacts of each may be

Shutdown

Once had a customer do this before we arrived

• Lost all memory evidence

• Lost some hard drive evidence

• Lost a lot knowledge of what the threat actors were doing

Same situation, different outcome

• Threat actors were done exfiltrating and had planted a self-destruct piece of malware

• Shutting down immediately stopped it from executing and allowed for a backup of the hard drive, etc, before the logic bomb could kick off

Disconnect from the network

Once had a customer do this ahead of time

• Killed a critical company-wide global trading application

• CFO said amount of money lost was unimaginable

Same situation, different outcome

• Threat actors had begun an exfiltration operation

• Appeared to be getting everything

• The act of disconnecting that group of servers stopped them before they got to any customer data

Leave connected and observe

Advised customer to allow us to observe and hunt for 72 hours

• Discovered that the "compromised" machines were only compromised to distract

• Real objective was data on a completely different segment of the network previously unkown to be accessed

• End result: We found the threat actor's true objective, which led to more complete eradication

One organization followed this process for two weeks

• It was during that two weeks that the threat actors took the most important data

Scope and assessment importance

Previous examples show how varied specifics can be

Proper assessment and scoping helps

• Discourages minimizes heroics and shotgun decisions

• Keeps the whole team focused and on-mission