Stopping it spreading.
WHAT CONTAINMENT MEANS
Preventing further harm while you establish what happened.
WHAT TO DO
Disconnect affected devices from the network Suspend compromised accounts Revoke sessions and tokens Change credentials from clean devices
THE SESSIONS POINT
Changing a password does not always end existing sessions.
End them explicitly.
WHAT ELSE TO REVOKE
Application access API keys Remote access
WHAT TO CHECK FOR
Additional accounts created Rules and forwarding added Scheduled tasks added
THAT LAST ONE
Scheduled tasks are used to restore access after cleanup.
Check them.
WHAT NOT TO DO
Wipe a device immediately, if you may need to understand what happened Continue using an affected system
WHAT TO PRESERVE
Logs, messages, and the state of affected systems, where feasible.
WHAT TO PRIORITISE
Anything holding money or customer data.
WHEN TO GET HELP
When the scope is unclear, or data is involved.
