Containment strategies in Cybersecurity - Mini Project: Build & Apply

Containment Strategies in Cybersecurity

📖 Scenario: You are part of a cybersecurity team managing a company's network. A security incident has been detected, and you need to understand and apply containment strategies to limit the damage.

🎯 Goal: Build a simple step-by-step plan that outlines containment strategies used in cybersecurity to isolate and control threats during an incident.

📋 What You'll Learn

Define a list called containment_strategies with initial containment methods

Add a variable called priority_level to set the urgency of containment

Use a for loop with variables index and strategy to list strategies with their order

Add a final step that marks the containment plan as completed = True

💡 Why This Matters

🌍 Real World

Containment strategies are critical in cybersecurity to quickly isolate threats and prevent further damage during security incidents.

💼 Career

Understanding and applying containment strategies is essential for cybersecurity professionals working in incident response and network defense roles.

1

Create initial containment strategies list

Create a list called containment_strategies with these exact strings: 'Isolate affected systems', 'Block malicious IPs', 'Disable compromised accounts'.

Cybersecurity

# Create the list containment_strategies with the given methods
# Your code here

Hint

Use square brackets [] to create a list and separate items with commas.

2

Set priority level for containment

Add a variable called priority_level and set it to the string 'High' to indicate urgency.

Cybersecurity

containment_strategies = ['Isolate affected systems', 'Block malicious IPs', 'Disable compromised accounts']
# Set priority_level to 'High'
# Your code here

Hint

Assign the string 'High' to the variable priority_level using the equals sign.

3

List containment strategies with order

Use a for loop with variables index and strategy to iterate over enumerate(containment_strategies, 1). Inside the loop, create a string step_description that combines the index and strategy like f"Step {index}: {strategy}".

Cybersecurity

containment_strategies = ['Isolate affected systems', 'Block malicious IPs', 'Disable compromised accounts']
priority_level = 'High'
# Use a for loop with index and strategy from enumerate(containment_strategies, 1)
# Create step_description using f-string
# Your code here

Hint

Use enumerate() to get both the position and the item from the list. Use an f-string to format the step description.

4

Mark containment plan as completed

Add a variable called completed and set it to True to indicate the containment plan is finished.

Cybersecurity

containment_strategies = ['Isolate affected systems', 'Block malicious IPs', 'Disable compromised accounts']
priority_level = 'High'
for index, strategy in enumerate(containment_strategies, 1):
    step_description = f"Step {index}: {strategy}"
# Set completed to True
# Your code here

Hint

Assign the boolean value True to the variable completed.

Practice

1. What is the main goal of containment strategies in cybersecurity?

easy

A. To improve system performance

B. To recover lost data after an attack

C. To identify the attacker's location

D. To stop a cyber attack from spreading further

Solution

1. Step 1: Understand containment purpose

   Containment strategies focus on limiting damage during an attack.

2. Step 2: Identify the key goal

   The key goal is to stop the attack from spreading to other systems.

3. Final Answer:

   To stop a cyber attack from spreading further -> Option D

4. Quick Check:

   Containment = Stop spread [OK]

Hint: Containment means stopping spread quickly [OK]

Common Mistakes:

• Confusing containment with recovery
• Thinking containment finds attackers
• Assuming containment improves speed

2. Which of the following is a correct containment action during a cyber attack?

easy

A. Disconnecting affected devices from the network

B. Running a full system backup after the attack ends

C. Increasing user privileges to speed recovery

D. Ignoring alerts to avoid false alarms

Solution

1. Step 1: Identify containment actions

   Containment involves isolating affected systems to stop spread.

2. Step 2: Evaluate options

   Disconnecting devices stops attackers from moving laterally.

3. Final Answer:

   Disconnecting affected devices from the network -> Option A

4. Quick Check:

   Isolation = Disconnect devices [OK]

Hint: Containment isolates affected devices fast [OK]

Common Mistakes:

• Confusing containment with recovery steps
• Thinking increasing privileges helps containment
• Ignoring alerts delays response

3. Consider this scenario: A malware infection is detected on a company computer. Which containment step should happen first?

medium

A. Notify all employees to change passwords immediately

B. Disconnect the infected computer from the network

C. Run a full antivirus scan on all company devices

D. Delete all files on the infected computer

Solution

1. Step 1: Analyze immediate containment needs

   Stopping spread requires isolating the infected device quickly.

2. Step 2: Choose the first containment action

   Disconnecting the infected computer prevents malware from spreading.

3. Final Answer:

   Disconnect the infected computer from the network -> Option B

4. Quick Check:

   First step = Disconnect infected device [OK]

Hint: Isolate infected device before other actions [OK]

Common Mistakes:

• Starting with password changes instead of isolation
• Running scans before stopping spread
• Deleting files without backup

4. A company tried to contain a ransomware attack by disconnecting only some infected devices. Why might this containment fail?

medium

A. Because ransomware cannot spread over networks

B. Because disconnecting devices causes data loss

C. Because attackers can spread through other connected devices

D. Because containment requires deleting files immediately

Solution

1. Step 1: Understand partial containment risks

   Leaving some infected devices connected allows attackers to spread.

2. Step 2: Identify why partial isolation fails

   Attackers move through networked devices not fully isolated.

3. Final Answer:

   Because attackers can spread through other connected devices -> Option C

4. Quick Check:

   Partial isolation = Spread continues [OK]

Hint: Partial isolation lets attackers spread [OK]

Common Mistakes:

• Thinking disconnect causes data loss
• Believing ransomware can't spread via network
• Assuming deleting files is containment

5. A company uses network segmentation as a containment strategy. What is the main benefit of this approach?

hard

A. It limits attacker access to only parts of the network

B. It automatically removes malware from infected devices

C. It speeds up internet connection for all users

D. It prevents all cyber attacks completely

Solution

1. Step 1: Understand network segmentation

   Network segmentation divides a network into smaller parts to control access.

2. Step 2: Identify containment benefit

   This limits attackers to only one segment, preventing full network access.

3. Final Answer:

   It limits attacker access to only parts of the network -> Option A

4. Quick Check:

   Segmentation = Limit attacker access [OK]

Hint: Segmentation blocks attacker spread by sections [OK]

Common Mistakes:

• Thinking segmentation removes malware automatically
• Assuming segmentation improves internet speed
• Believing segmentation stops all attacks