Lessons · Cybersecurity · isolate before you investigate
Isolate before you investigate
When a machine is doing harm, take it off the network first and study it afterwards, because every minute of investigation is another minute of spreading.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
The analyst wanted five more minutes to see what the process was doing. In those five minutes it reached two file shares. Containment is not the interesting part of the job, and it is the part that decides how big the incident gets.
How to think about it
Isolate means remove the machine's ability to reach anything else, not switch it off: pull the network cable or block the port, leave it running, keep the user away from the keyboard. Then investigate from the copy and the logs.
Worked example
Step 1: disconnect the network, leave the power onOff the network it can do no more harm; still running, it keeps what is in memory.
Step 2: note the time you did it, to the minuteThe timeline needs this line as much as it needs the attacker's.
Step 3: keep the user off it, and take the ticket numberOne machine, one owner, one record.
Step 4: now investigate, from the logs and a copyThe interesting work, done with the bleeding stopped.
Your turn
A laptop is spreading malware across the network. Write the first thing you do to it.
first: it from the network
Solve one, graded on the server
The trap
Switching it off to be safe. Power off loses what was in memory, which is often the evidence that says what was taken, and it does not undo anything that already spread.