Incident › Module 5 › Lesson 1
Containment Options
Containment options literacy names network isolation, account disable, host quarantine, and DNS blocks — evaluate options on YOUR $IR_LAB org assets only.
Visual · t34_containment_options
Containment options literacy. $IR_LAB only. Original Cyberlium.
Opening
Containment stops spread — literacy names options so tabletop decisions target YOUR org assets, never stranger networks or destructive payloads.
Containment options include host network isolation via EDR, account disable in IdP, firewall block rules, DNS sinkhole, and temporary VLAN move — all on systems YOUR org owns. Each option trades spread prevention against business disruption. IC approves containment with scribe logging decision rationale. Cyberlium lists containment options on YOUR $IR_LAB — match three options to fictional tabletop scenario with pros and cons. Next: Short vs Long.
1. Containment options (named)
Host isolation: EDR network containment on enrolled endpoint — YOUR org asset. Account disable: IdP lock for compromised credential. Network block: firewall deny for C2 IP on YOUR perimeter. Service stop: pause affected app tier with change approval.
On $IR_LAB, write options table — option, asset scope, disruption note, IC approval flag for fictional inject.
Command guide
Try these commands — Containment options (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final CISA Stop Ransomware — https://www.cisa.gov/stopransomware SANS IR — https://www.sans.org/for-organizations/incident-response/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/containment/containment-options-named.txt" <<'EOF'
Containment options — NAMED LITERACY (authorized YOUR org only):
Network: VLAN isolation, firewall deny, disable VPN session
Host: EDR network quarantine, disable NIC — YOUR managed assets
Account: disable AD account, revoke tokens, force password reset
Email: purge/quarantine malicious messages org-wide
Data: snapshot before change; block exfil domains at proxy
HARD BAN: live isolation of stranger hosts; unauthorized network changes
Lab: document which option for tabletop scenario — do not execute on prod strangers
EOFCommand — copy this
grep -E 'Network|Account|HARD BAN|stranger' "$IR_LAB/containment/containment-options-named.txt" curl -sS https://www.cisa.gov/stopransomware | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); CISA Stop Ransomware (https://www.cisa.gov/stopransomware); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why options literacy prevents wrong-tool containment
DNS block misses IP-direct C2. Account disable without session revoke leaves active tokens. Tabletops compare options before production adrenaline.
Students evaluate lab options on notes — production containment follows change control and asset inventory.
3. Lab boundary
Forbidden: containment steps on stranger ISP, cloud tenants, or ransomware deployment. Allowed: containment options card — three options on $IR_LAB YOUR org assets only.
Ship: containment options card for YOUR lab scenario. Next: Short vs Long.
4. What you ship: containment options card for $IR_LAB
Three options with scope and disruption notes. $IR_LAB named. YOUR org only. chmod 600.
5. What you record before the next lesson
Date. Containment options card. $IR_LAB named. File t34-m05-l01-containment-options.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Isolate stranger cloud tenant for practice. Deploy ransomware to 'test containment.'
Right
Write containment options card for YOUR $IR_LAB org assets. Next: Short vs Long.
Mission: list containment options on YOUR lab
1) Name four containment options. 2) Match three to fictional scenario with pros/cons. 3) Confirm YOUR org asset scope only. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Every containment option needs asset scope — if you do not own it, you do not isolate it.
Knowledge Check
APPLY: Host network isolation via EDR applies to:
Multiple choice
Knowledge Check
APPLY: True or False: Containment decisions should be IC-approved and scribe-logged.
True or False
Knowledge Check
APPLY: Containment options literacy on Cyberlium avoids:
Multiple choice