What is the goal of a Network Containment Policy?

A Network Containment Policy is a fundamental component of an incident response strategy. Its primary goal is to isolate a compromised host or network segment to prevent a security threat, such as malware or an attacker, from spreading to other parts of the network. By quarantining the affected system(s), the policy effectively limits the scope and impact of the security incident. This action contains the damage and provides security analysts with the necessary time to perform eradication and recovery procedures without the risk of further propagation.

A. Increasing policy aggressiveness is a separate action related to tuning prevention controls, not the primary goal of containment, which focuses on isolation.
C. Gaining visibility is part of the detection and analysis phase of incident response, which occurs before the containment action is taken.
D. Partitioning a network for privacy describes network segmentation, which is a proactive architectural design, not a reactive incident response goal like containment.

1. NIST Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide: Section 3.3.2

"Containment

" states

"Containment is important before an incident overwhelms resources or increases damage... The primary goal of this phase is to stop the incident from causing further damage to the organization." This directly supports the goal of limiting impact.

2. Carnegie Mellon University

Software Engineering Institute

Defining Incident Management Processes for CSIRTs: A Work in Progress: In the discussion of the "Containment

Eradication

and Recovery" phase

the document emphasizes that the goal of containment is to "limit the extent of the damage and to prevent any further damage from occurring." (CMU/SEI-2004-TR-015

Section 4.3.3).

3. CrowdStrike

Falcon Platform Documentation: In the documentation for its Endpoint Detection and Response (EDR) solution

the "Network Containment" feature is described as a tool to "quarantine a managed device to prevent it from accessing your network... This is useful for preventing a threat from spreading." This vendor documentation aligns containment with limiting the impact of a compromised host.