Prefer reversible containment
Contain the threat with the move you can take back.
Most security threats can be contained more than one way, and the ways differ in how recoverable they are. Quarantining a host’s network access stops lateral movement and can be lifted in seconds; killing the suspect process stops it too but loses the forensic state and cannot be undone. Blocking an indicator temporarily buys time; a permanent firewall change is a standing liability. When the containment value is comparable, the reversible option is strictly better: it buys the same time-to-safety while keeping the cost of a wrong call recoverable.
This is not “never take irreversible action.” It is “do not take the irreversible action when a reversible one would do.” Reach for the process kill, the account deletion, the estate-wide block only when a reversible move genuinely cannot contain the threat — and when you do, that action is exactly the kind that [[never-auto-execute-irreversible-or-estate-wide-response|requires human approval]].
How to apply
- Rank by reversibility, then blast radius. Among candidate responses, prefer the one you can undo and that touches the fewest assets.
- Default to temporary. A block with an expiry, a quarantine that auto-lifts, a token revoke that can be re-issued — prefer the bounded form.
- Preserve evidence. A reversible containment usually keeps the host and its state intact for investigation; an irreversible one often destroys it.
- Escalate, don’t reach. If only an irreversible or estate-wide action will contain it, that is a signal to bring a human in, not to act faster alone.
Related principles
never-auto-execute-irreversible-or-estate-wide-response— the commandment this core principle serves: the irreversible action you avoid here is the one that always needs human approval there.