Incident › Module 5 › Lesson 2
Short vs Long
Short vs long containment literacy contrasts emergency blocks with sustained segmentation — plan both tiers on YOUR $IR_LAB tabletop timelines.
Visual · t34_short_vs_long
Short vs long containment literacy. $IR_LAB only. Original Cyberlium.
Opening
Stop the bleed, then rebuild the wall — literacy teaches short emergency containment vs long-term segmentation on YOUR org architecture you document.
Short-term containment is immediate — isolate host, disable account, block IOC — minutes to hours. Long-term containment is architectural — network segmentation, privileged access rework, enhanced monitoring zones — days to weeks. Both require IC approval; long-term routes through change advisory board on YOUR org systems. Cyberlium contrasts short vs long on YOUR $IR_LAB — one short action and one long action for fictional ransomware tabletop with no payload. Next: Decision Trees.
1. Short vs long containment (named)
Short-term: EDR isolate, emergency firewall rule, disable compromised account — stop active spread now. Long-term: segment VLAN, remove standing admin, deploy application allow-listing — reduce recurrence risk. Document handoff from short to long in scribe log.
On $IR_LAB, write contrast row — short action, long action, owner role, fictional timeline for tabletop org.
Command guide
Try these commands — Short vs long containment (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final CISA — https://www.cisa.gov/stopransomware FIRST — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/containment/short-vs-long-containment.md" <<'EOF'
# Short-term vs Long-term Containment — YOUR notes
## Short-term (minutes–hours)
- Isolate affected segment; block known-bad IOCs at perimeter
- Disable compromised accounts; preserve volatile evidence
- Goal: stop spread while keeping business-critical systems running if safe
## Long-term (hours–days)
- Rebuild from gold images; segment redesign; patch root vuln
- Enhanced monitoring on related assets
- Goal: sustainable secure state before recovery
Tabletop: list short vs long actions for LAB-IR-RANSOM-001 — markdown only
EOFCommand — copy this
grep -E 'Short-term|Long-term|LAB-IR-RANSOM' "$IR_LAB/containment/short-vs-long-containment.md"
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); CISA (https://www.cisa.gov/stopransomware); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why both tiers matter in PICERL
Short-only leaves architecture vulnerable to repeat intrusion. Long-only delays stop spread during active exfiltration. Mature IR plans sequence both with clear triggers.
Students plan both tiers on lab notes — production long-term routes through CAB and architecture review.
3. Lab boundary
Forbidden: long-term changes on stranger infrastructure. Allowed: short vs long card — paired actions on $IR_LAB YOUR org with tabletop narrative only.
Ship: short vs long containment card for YOUR lab. Next: Decision Trees.
4. What you ship: short vs long containment card for $IR_LAB
Short and long action pair with owners. $IR_LAB named. chmod 600.
5. What you record before the next lesson
Date. Short vs long card. $IR_LAB named. File t34-m05-l02-short-vs-long.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip long-term planning after emergency isolate. Change stranger network architecture in lab.
Right
Write short vs long containment card for YOUR $IR_LAB. Next: Decision Trees.
Mission: plan short and long containment on YOUR lab
1) Define short vs long in one sentence each. 2) Write one example action per tier. 3) Assign owner role per action. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Short stops today — long stops tomorrow. Tabletop both in every ransomware narrative drill.
Knowledge Check
APPLY: Short-term containment primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Long-term containment may require change advisory board approval.
True or False
Knowledge Check
APPLY: Short vs long literacy on Cyberlium uses:
Multiple choice