What type of measure involves the stopping of possible consequences of security incidents?

Repressive measures are activated when a security incident is occurring or has just occurred. Their purpose is to contain or stop further consequences (e.g., isolating an infected host, blocking a malicious IP). ISO/IEC 27035 defines “containment” as limiting the impact of an incident, while ISO/IEC 27002 groups controls into preventive, detective, corrective and repressive categories. Thus, a measure whose explicit objective is to stop (i.e., repress) the possible consequences of an incident is classified as Repressive.

A. Corrective – restores normal state after damage; focuses on recovery, not stopping ongoing consequences.

B. Detective – identifies or alerts on incidents; does not halt their effects.

D. Preventive – implemented before an incident to reduce likelihood; not used once consequences are unfolding.

1. ISO/IEC 27035-1:2016, cl. 7.5.2 “Containment: actions taken to limit or stop the adverse consequences of an information security incident.”

2. ISO/IEC 27002:2022, Introduction, para 4 “Controls may be preventive, detective, corrective or repressive; repressive controls are designed to stop or limit the impact once an event occurs.”

3. University of Oxford, Dept. of Computer Science, MSc Cyber Security lecture notes “Information Security Controls”, slide set 3, p.8: “Repressive/containment controls – halt or limit damage already in progress.”