Skip to main content

Contain and Withstand

Overview​

The Contain and Withstand phase focuses on limiting the impact of security incidents by implementing effective isolation strategies and continuously improving containment measures. By proactively containing threats, organizations can minimize the potential damage and ensure the resilience of their infrastructure.

Key Components​

Quarantine Isolation Levels and Zones​

Quarantine Isolation Levels and Zones define containment strategies that prevent unauthorized lateral movement and restrict potential threats to designated areas. Establishing structured isolation levels ensures that security incidents are contained before they escalate.

Test and Refine Isolation Policies​

Test and Refine Isolation Policies involves continuously evaluating containment measures to enhance their effectiveness. Regular testing ensures that isolation policies remain adaptive to evolving threats and provide robust security against potential breaches.

Conclusion​

By implementing the Contain and Withstand phase, organizations can ensure that security threats are effectively contained, minimizing disruption and safeguarding critical assets. Through Quarantine Isolation Levels and Zones and Testing and Refining Isolation Policies, security teams can enhance incident response and improve overall resilience.