Appropriate Actions During the Containment Phase of Incident Response

Quick Answer

Blocking malicious IP addresses at the firewall is a core containment action because containment's entire purpose is to stop an incident from getting worse while the investigation continues, and cutting off communication with known attacker infrastructure does exactly that at the network level. Once malicious IPs are identified, typically the addresses associated with command-and-control servers or the attacker's point of origin, blocking them at the firewall immediately denies the attacker further access to affected systems and prevents ongoing data exfiltration or remote command execution, without requiring the incident to be fully investigated first. This pairs naturally with isolating the affected system from the network, since both actions share the same containment goal of severing the attacker's channels: isolating the host stops it from spreading laterally to other internal systems, while blocking the IP stops external communication regardless of which internal host the attacker might reach next. Containment actions are deliberately fast, in contrast to eradication steps like removing malware or patching vulnerabilities, which come later once the scope of the incident is better understood. When a question asks what belongs in the containment phase specifically, look for actions that immediately cut off attacker access or communication, such as network isolation, IP blocking, or disabling compromised accounts, rather than actions that clean up or prevent recurrence, which belong to eradication and recovery.