Manage

Manage means containing an attack as close to its source as possible so that it cannot spread further through the organisation's systems. What the investigation uncovers about the attack's type and the damage it is doing decides how heavy the containment needs to be.

Containing the threat

One way to contain an attack is by disabling a compromised user account — switching off the account being used to break in, so the attacker loses that route. If a college's timetable account starts sending strange messages to staff, disabling it stops the attacker reaching anything else.

Containment can also mean quarantining suspicious files, moving them to a safe holding area where they cannot run or spread. If a dental surgery's reception computer flags an email attachment, quarantining it stops the malicious code opening on other machines.

Another method is isolating affected systems, such as moving a leisure centre's booking server onto its own separate part of the network while it is checked. The organisation can also block unauthorised network traffic, for example blocking all connections from an unknown address that keeps trying to reach a school's network.

The right size of response

Management has to match the attack's type and severity. A single compromised password might only need changing, while an attack spreading between servers may mean shutting down a whole section of the network. Reacting hugely to a small incident wastes time and money; reacting lightly to a serious one lets it spread.

Protecting evidence

Manage also includes protecting and preserving evidence, such as logs, affected devices and copies of suspicious files, because it may be needed for a possible criminal investigation. Evidence is easily destroyed, so devices are left as they were found rather than wiped.

Returning data from a backup belongs to recover, not manage. Restoring old data over live data while the attack is still running would destroy evidence and would not contain the attacker.

The benefit is that the attack is contained and cannot spread, and evidence is preserved for later examination.