When ransomware is confirmed in your environment, every instinct pushes toward recovery. Get systems back online. Restore from backup. Call someone who can fix it. These instincts are understandable and they are all wrong as first actions.
The first action is containment. Not recovery. Not payment. Not notification. Not a call to your EHR vendor or your internet service provider. Containment.
Containment is the action that determines the scope of everything that follows. Recovery from a contained incident that reached five systems is a fundamentally different undertaking than recovery from an uncontained incident that reached five hundred. The forensic investigation of a contained incident preserves evidence that an uncontained incident destroys through the spread itself. The regulatory notification scope of a contained incident is bounded by the data on the systems that were reached before containment. The total cost of a contained incident is a fraction of the total cost of an incident where containment was delayed by recovery instincts.
This article covers exactly what containment means during a ransomware attack, why it must happen before everything else, the specific actions that constitute effective containment in the correct sequence, and the mistakes that extend the incident scope when they are made before containment is complete.
Organizations preparing for ransomware should also review cybersecurity services, incident response services, and managed IT services.
Why Containment Before Everything Else
The case for containment before all other actions is not procedural preference. It is operational reality grounded in how ransomware attacks work and what determines their outcome.
Ransomware Spreads While You Are Doing Other Things
Every action that is not containment is time during which ransomware continues spreading. A ransomware variant optimized for speed can encrypt tens of thousands of files per minute. An administrator who spends 20 minutes attempting to identify the ransomware variant before executing containment has given the attack 20 minutes of additional spread time. An organization that spends the first hour discussing who should make decisions has given the attack an hour.
The instinct to understand before acting is rational in most operational contexts. In ransomware response, it is damaging. The understanding that matters for recovery can be developed after containment is complete. The spread that occurs before containment cannot be undone.
Every Uncontained System Is a New Vector
Every system that is infected and remains connected to the network is actively spreading ransomware to additional systems. The encrypted systems that have already been affected by the time ransomware is detected are the systems the attacker reached during the dwell period before encryption began. The systems that become infected after detection are the systems that spread because containment was delayed.
That distinction matters operationally because post-detection spread is entirely preventable. The systems encrypted during the dwell period before detection represent unavoidable damage from the attack. The systems encrypted after detection represent the cost of delayed containment. Minimizing post-detection spread through fast containment is the most direct operational lever available to the responding team.
Organizations improving detection and containment should also evaluate network security monitoring and ransomware protection services.
Containment Preserves Recovery Options
Containment that prevents ransomware from reaching backup infrastructure preserves the primary recovery path. Backup systems that are reached before containment and are encrypted or deleted eliminate the recovery path that would have enabled fast, reliable restoration without payment.
The specific targeting of backup infrastructure during ransomware attacks is deliberate. Attackers who have eliminated the victim’s backup infrastructure have maximized their leverage because the only remaining recovery paths, payment for decryption or full system rebuild, are both more expensive and slower than backup restoration. Every minute of delayed containment is additional time during which the attacker may reach backup systems that containment would have protected.
Organizations strengthening recovery options should also review air-gapped backup strategies and cloud services.
Containment Preserves Forensic Evidence
The forensic investigation that identifies the entry point, maps the lateral movement, and determines what data was accessed depends on evidence that exists on infected systems at the time of containment. That evidence is preserved when systems are isolated from the network while powered on and is destroyed when systems are shut down, wiped, or when the attacker’s continued access allows them to delete it.
Containment that isolates infected systems from the network while keeping them powered on is the specific action that preserves this evidence. Recovery actions taken before containment, including wiping and reimaging infected systems to restore them to operation faster, destroy the evidence the investigation requires.
The Containment Actions in the Correct Sequence
Containment is not a single action. It is a sequence of specific actions executed in an order that maximizes the speed of spread prevention while minimizing the mistakes that make the situation worse.
Step One: Confirm Before Scaling Response
The confirmation step is the only place in the containment sequence where a brief pause is operationally appropriate. Initiating a full organizational emergency response based on a single user’s report of inaccessible files when the actual cause is a local storage failure wastes resources and creates organizational disruption. Confirming that ransomware is actually present before executing the full containment sequence takes minutes and prevents that waste.
Confirmation does not require forensic certainty. It requires enough signal to distinguish ransomware from other causes of file inaccessibility. Ransomware confirmation signals include ransom notes appearing on screens or in affected directories, files with altered extensions appearing across multiple systems simultaneously, security tool alerts indicating encryption activity or known ransomware process signatures, and multiple users in different departments reporting inaccessible files within minutes of each other.
A single system showing file access problems is not ransomware until other signals support that conclusion. Multiple systems showing the same pattern simultaneously is ransomware until proven otherwise. When in doubt, treat it as ransomware. The cost of unnecessary containment is operational disruption. The cost of delayed containment is additional encryption.
Step Two: Isolate Infected Systems From the Network Immediately
The moment ransomware is confirmed, network isolation of infected systems begins. This is not a decision that requires escalation or authorization. It is a pre-authorized action that must execute immediately.
Network isolation means removing the infected system’s ability to communicate with any other system on the network. The method depends on the connection type.
For wired connections, physically disconnect the network cable. This is the fastest, most reliable, and most unambiguous isolation method. It does not depend on the infected system’s operating system responding correctly to software commands. It does not depend on network management tool access. It requires no credentials and no remote access. Pull the cable.
For wireless systems, disable the wireless adapter through the operating system if it is responsive. If the operating system is not responsive due to encryption activity, disable the wireless access point serving the affected area. Disabling the AP removes network connectivity from all devices on it simultaneously, which is faster than device-by-device adapter disabling when multiple systems are affected.
For virtual machines, disconnect network interfaces through the hypervisor management console. Execute this at the hypervisor level rather than within the VM. A ransomware-affected VM cannot be trusted to execute isolation commands correctly, and hypervisor-level isolation is more reliable and more immediate.
For servers, the isolation decision requires awareness of the downstream impact. A domain controller that is isolated disrupts authentication across the environment. A file server that is isolated disrupts shared data access. A database server that is isolated disrupts every application that depends on it. These consequences are preferable to allowing ransomware to continue encrypting from the server, but the response team must be aware of the operational impact and coordinate service continuity responses in parallel with isolation.
Do not shut down infected systems during isolation. Volatile memory on powered-on systems contains forensic evidence including the ransomware executable, encryption key material, attacker tools and scripts, and authentication tokens that are destroyed permanently on shutdown. Isolate infected systems from the network. Do not shut them down.
Step Three: Disable Switch Ports for Affected Network Segments
Individual system isolation addresses systems that are confirmed infected. Switch port disabling addresses entire network segments where infection may be spreading faster than individual systems can be identified and isolated.
When new systems are being encrypted faster than they can be individually identified and isolated, segment-level containment through switch port disabling is the appropriate response even though its operational disruption blast radius is larger than individual system isolation. The operational disruption of taking down a network segment is recoverable. The encryption of additional systems during delayed individual isolation is not.
Switch port disabling requires access to network switch management interfaces with appropriate credentials. Those credentials must be documented and accessible outside the production environment before an incident. An administrator who must spend 20 minutes locating switch management access credentials during an active ransomware event has given the attack 20 additional minutes of spread time.
Step Four: Disable Remote Access Infrastructure
Remote access infrastructure must be disabled during active containment. VPN concentrators, Remote Desktop Gateway, and any remote monitoring and management tools that provide connectivity into the environment from outside must be shut down.
The reasons are specific. Ransomware operators frequently maintain access to environments through remote access infrastructure. Disabling that infrastructure closes the external pathway and prevents the attacker from establishing new remote sessions during the containment phase or re-entering after partial containment has been executed.
For organizations where remote access infrastructure is essential to business operations, the disruption of disabling VPN and remote desktop services is significant. That disruption is consistently preferable to leaving the attacker an active pathway into the environment during containment.
Remote access infrastructure that is disabled for containment must be fully reviewed, reconfigured, and confirmed clean before it is re-enabled. Multiple documented ransomware incidents have involved reinfection through remote access infrastructure that was re-enabled without confirmation that the attacker’s access had been eliminated.
Step Five: Establish Out-of-Band Communication
If your organizational communication infrastructure may be affected by the incident, establish a communication channel for the response team that does not depend on it before that channel becomes unavailable or untrusted.
An attacker who maintains access to organizational communication infrastructure can monitor response coordination. Using potentially compromised email or collaboration platforms for response team communication provides the attacker visibility into containment actions, allowing adjustment of their behavior to evade the specific containment steps being taken.
Personal mobile phones and personal email accounts provide communication capability that does not depend on organizational infrastructure. Establish this channel and move all response coordination to it as part of the containment sequence, not as an afterthought when the compromised communication infrastructure becomes obviously unavailable.
Step Six: Assess the Scope of Infection Before Any Recovery Action
After initial containment actions are complete, the scope of infection must be assessed before any recovery action begins. This assessment is the bridge between containment and recovery, and its completeness determines whether recovery is executed in the correct scope.
Recovery that begins before the scope assessment is complete consistently encounters infected systems that were not identified during initial assessment and have continued encrypting during the recovery of other systems. The partial containment that results from incomplete scope assessment produces partial recovery that must be repeated when additional infected systems are discovered mid-process.
Scope assessment examines Active Directory authentication logs to identify systems that authenticated with potentially compromised credentials during the dwell period, network flow data to identify systems that communicated with confirmed infected systems during the spread window, endpoint detection alert logs to identify all systems where ransomware-associated process activity was detected, and user and help desk reports to identify systems reported as inaccessible that have not generated automated alerts.
The scope assessment output is a definitive inventory of confirmed infected, potentially infected, and confirmed clean systems. That inventory drives all subsequent recovery prioritization and prevents recovery from proceeding into a scope that is not fully understood.
Organizations improving response sequencing should also review business continuity planning and co-managed IT services.
What Not to Do Before Containment Is Complete
The actions that extend ransomware damage are almost always taken before containment is complete, motivated by recovery instincts that are appropriate after containment but counterproductive before it.
Do Not Shut Down Infected Systems
Shutting down infected systems to stop the encryption is the most common containment mistake. It feels logical because the encryption stops when the system is shut down. It is counterproductive because it permanently destroys the volatile memory evidence that the investigation requires and that may contain encryption key material that could enable recovery without payment.
The correct action is network isolation, not shutdown. Network isolation stops the spread without destroying the evidence. The encryption process on an isolated system will eventually exhaust the locally accessible files and stop on its own, without the evidence destruction that shutdown causes.
Do Not Wipe or Reimage Infected Systems Immediately
The instinct to immediately reimage infected systems to restore them to a known-clean state destroys forensic evidence and frequently occurs before the full scope of infection is understood. Reimaging is appropriate during the restoration phase, after forensic evidence has been preserved, the full infection scope has been assessed, and the attacker’s access has been eliminated. It is not an appropriate containment action.
Do Not Attempt to Decrypt or Restore Files Before Containment Is Complete
The pressure to restore encrypted files as quickly as possible is significant, particularly for organizations where file access is essential to operations. Attempting decryption or restoration before containment is complete and the attacker’s access has been eliminated consistently produces reinfection of restored systems.
Files and systems restored into an environment where the attacker maintains access through unresolved persistence mechanisms are immediately available for re-encryption. Recovery work performed before the environment is confirmed clean must be repeated, and the time and resources invested in premature restoration are wasted while extending the total recovery timeline.
Do Not Pay Before Completing Containment
Payment decisions made before containment is complete and the attacker’s access has been eliminated are made without the information needed to evaluate the decision correctly. An organization that pays and receives a decryption key while the attacker maintains active access through unaddressed persistence mechanisms is decrypting files into a still-compromised environment.
All payment decisions must follow completion of containment, scope assessment, backup availability assessment, and legal review. The attacker’s deadline is a pressure tactic designed to push organizations into decisions before they have completed the assessment sequence that would identify alternatives to payment.
Do Not Communicate Externally About the Incident Before Legal Review
Statements made to customers, employees, partners, or media during an active ransomware incident before legal review have legal implications that unreviewed communication can create or worsen. The pressure to communicate quickly is real. Premature communication that proves inaccurate when additional information emerges creates additional legal exposure. Legal counsel must review all external communications before they are made.
What Containment Does Not Do
Understanding the limits of containment prevents the mistake of treating containment as resolution.
Containment stops spread. It does not remove the ransomware from systems that are already infected. Those systems remain infected and cannot be safely reconnected to the network until threat elimination is complete.
Containment does not eliminate the attacker’s access. An attacker who has established persistence through backdoors, new administrative accounts, or Active Directory modifications retains the ability to reactivate that access when isolation is lifted unless threat elimination specifically addresses those persistence mechanisms.
Containment does not address the exfiltration that occurred before the encryption event. Data that was copied and transferred out of the environment during the dwell period remains in the attacker’s possession regardless of containment. The publication threat from double extortion exists independently of containment.
Containment does not restart the clock on regulatory notification obligations. The notification timelines that apply to regulated industries run from the moment of discovery, not from the completion of containment. Legal and compliance response must begin during containment, not after it.
Organizations managing regulated data should also evaluate cybersecurity compliance services and double extortion ransomware.
The Preparation That Makes Fast Containment Possible
The organizations that execute fast, effective containment during an active ransomware event do so because specific preparation investments were made before the incident required them.
Pre-authorized containment actions that do not require approval chain completion before execution. The person who identifies ransomware must have authority to begin isolation actions immediately. Containment authority must be pre-established, documented, and communicated to the people who will exercise it before an incident requires it.
Network architecture documentation accessible outside the production environment that maps switch locations, port assignments, VLAN configurations, and management interface access for all network infrastructure. Containment actions that require locating this information during an active incident are delayed by that search.
Switch and network device management credentials stored securely outside the production environment, accessible to the people who will need them during containment without depending on systems that may be affected by the incident.
Remote access infrastructure inventory identifying every VPN concentrator, RDG server, and remote monitoring tool in the environment with the steps required to disable each.
Out-of-band communication channel established and tested before an incident, so the response team has a reliable coordination mechanism from the first minute of the event.
Practiced containment procedures through tabletop exercises that include the specific isolation actions for your environment, so that the people executing containment have performed those actions before under simulated pressure.
Mindcore’s cybersecurity services and managed IT services help organizations build the incident response infrastructure, network documentation, and practiced procedures that make fast containment possible when it matters most.
Meet Our CEO, Matt Rosenthal
With more than 30 years of experience in business and technology leadership, Matt Rosenthal has guided organizations across healthcare, finance, legal, manufacturing, and defense through ransomware events where the speed and effectiveness of containment in the first minutes determined whether the incident was a manageable contained event or an extended organizational crisis. As President and CEO of Mindcore Technologies, Matt leads a team that helps organizations build the containment capability, pre-authorized procedures, and network documentation that make fast containment executable under pressure.
Matt’s approach to containment preparation is grounded in the recognition that containment speed is almost entirely a function of preparation. Organizations that have pre-authorized containment authority, documented their network architecture, and practiced their isolation procedures contain incidents in minutes. Organizations that discover their containment procedures during an active incident contain incidents in hours, after significant additional spread has occurred.
Frequently Asked Questions
How do you isolate a system that is in the middle of encrypting files?
Prioritize network disconnection over stopping the encryption process. Disconnecting the system from the network prevents spread to additional systems even while local encryption continues on the isolated machine. Once isolated, the encryption process will eventually exhaust the locally accessible files and stop without reaching additional network targets. Attempting to stop the encryption process before isolating the system risks the wrong priority: stopping local encryption while the system remains connected and capable of spreading to other systems.
What if the person with switch management access is unavailable?
This is a documented failure mode in organizations where network management access is concentrated in a single individual. The resolution is pre-incident preparation: multiple individuals with documented switch management access, credentials stored securely outside the production environment, and step-by-step switch isolation procedures that can be executed by any qualified team member. If this gap is discovered during an active incident, pursue the unavailable individual through every available channel while simultaneously executing whatever containment actions are available without switch management access.
Should we inform employees about what is happening during containment?
Employees who are not informed will continue attempting to use affected systems, creating additional spread risk, and will respond to customer and partner inquiries about system unavailability without approved messaging. Brief employees through out-of-band communication on what to do, what not to do, and what to say to external parties who ask about system availability. The content of what employees are told about the incident should be reviewed by legal counsel before distribution, but the operational guidance on system use and communication can be distributed immediately.
What if containment requires taking down systems that customers depend on?
Customer-facing systems that are infected or connected to infected systems must be isolated regardless of the customer impact, because continued operation of those systems risks spreading the ransomware further and creates quality and integrity risk in whatever customer transactions continue on the compromised systems. Customer communication about the service disruption, using legally reviewed messaging, should be activated as soon as containment actions that affect customer-facing systems are executed. The service disruption from containment is a bounded, recoverable cost. The consequences of continued spread through customer-facing systems are neither bounded nor recoverable.
Is there ever a situation where containment should wait?
Life safety situations create the only legitimate exception to immediate containment priority. If containing a specific system would immediately and directly create a life safety risk because of what that system controls in a healthcare, manufacturing, or critical infrastructure environment, the life safety decision takes precedence and containment of that specific system must be coordinated with the relevant safety personnel rather than executed immediately. This exception is narrow. It applies to systems whose containment creates immediate physical risk, not to systems whose containment creates operational or financial disruption. The financial and operational consequences of containment are always preferable to the consequences of continued spread.
Build the Containment Capability Before the Incident Requires It
The organizations that contain ransomware in minutes rather than hours have made the preparation investments that make fast containment executable. They have pre-authorized the actions, documented the network, stored the credentials, and practiced the procedures.
The organizations that contain ransomware in hours rather than minutes discover their containment procedures during the incident. The additional spread that occurs in those hours, additional systems encrypted, backup infrastructure potentially reached, forensic evidence potentially destroyed, is the direct cost of preparation gaps.
Containment is the first action in ransomware response because everything that follows is determined by how fast and how completely it is executed. That determination is made before the incident, not during it.
Mindcore’s cybersecurity services and managed IT services help organizations across healthcare, finance, legal, manufacturing, and defense build the pre-authorized containment procedures, network documentation, and practiced response capability that make fast containment executable when ransomware makes it necessary. If your organization does not have the containment infrastructure that would enable isolation within minutes of detection, contact Mindcore to build that capability before an incident measures the cost of not having it.
Source content adapted from uploaded file.
