Short vs Long

Short vs long containment literacy contrasts emergency blocks with sustained segmentation — plan both tiers on YOUR $IR_LAB tabletop timelines.

Short vs Long• Audio Walkthrough

00:00/03:29

Visual · t34_short_vs_long

Short vs long containment literacy. $IR_LAB only. Original Cyberlium.

Stop the bleed, then rebuild the wall — literacy teaches short emergency containment vs long-term segmentation on YOUR org architecture you document.

Short-term containment is immediate — isolate host, disable account, block IOC — minutes to hours. Long-term containment is architectural — network segmentation, privileged access rework, enhanced monitoring zones — days to weeks. Both require IC approval; long-term routes through change advisory board on YOUR org systems. Cyberlium contrasts short vs long on YOUR $IR_LAB — one short action and one long action for fictional ransomware tabletop with no payload. Next: Decision Trees.

1. Short vs long containment (named)

Short-term: EDR isolate, emergency firewall rule, disable compromised account — stop active spread now. Long-term: segment VLAN, remove standing admin, deploy application allow-listing — reduce recurrence risk. Document handoff from short to long in scribe log.

On $IR_LAB, write contrast row — short action, long action, owner role, fictional timeline for tabletop org.

Command guide

Try these commands — Short vs long containment (named)

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final CISA — https://www.cisa.gov/stopransomware FIRST — https://www.first.org/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install python3

macOS:

Command — copy this

brew install python3

Windows: Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/containment/short-vs-long-containment.md" <<'EOF'
# Short-term vs Long-term Containment — YOUR notes
## Short-term (minutes–hours)
- Isolate affected segment; block known-bad IOCs at perimeter
- Disable compromised accounts; preserve volatile evidence
- Goal: stop spread while keeping business-critical systems running if safe
## Long-term (hours–days)
- Rebuild from gold images; segment redesign; patch root vuln
- Enhanced monitoring on related assets
- Goal: sustainable secure state before recovery
Tabletop: list short vs long actions for LAB-IR-RANSOM-001 — markdown only
EOF

Command — copy this

grep -E 'Short-term|Long-term|LAB-IR-RANSOM' "$IR_LAB/containment/short-vs-long-containment.md"

Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); CISA (https://www.cisa.gov/stopransomware); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why both tiers matter in PICERL

Short-only leaves architecture vulnerable to repeat intrusion. Long-only delays stop spread during active exfiltration. Mature IR plans sequence both with clear triggers.

Students plan both tiers on lab notes — production long-term routes through CAB and architecture review.

3. Lab boundary

Forbidden: long-term changes on stranger infrastructure. Allowed: short vs long card — paired actions on $IR_LAB YOUR org with tabletop narrative only.

Ship: short vs long containment card for YOUR lab. Next: Decision Trees.

4. What you ship: short vs long containment card for $IR_LAB

Short and long action pair with owners. $IR_LAB named. chmod 600.

5. What you record before the next lesson

Date. Short vs long card. $IR_LAB named. File t34-m05-l02-short-vs-long.txt chmod 600.

6. Wrong vs right: stranger networks vs YOUR IR tabletop

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Skip long-term planning after emergency isolate. Change stranger network architecture in lab.
Right: Write short vs long containment card for YOUR $IR_LAB. Next: Decision Trees.

Hands-on Exercise