In incident response, there are commonly two approaches to isolation and containment after a genuine incident is reported.
- Compromised systems are disabled or disconnected but operations carries on by reverting to a redundant system until the incident is solved, or disconnected/disabled temporarily until the incident is resolved
- Compromised systems are not disabled or disconnected and normal operation carries on? But spend time to trace hackers and collect evidence??
In both approach, there are suggestions by experts that disconnection is not advisable because of forensics reasons. If so, then what is the best way to isolate/contain and incident so that it won't spread further and at the same time I don't let the hacker know we have already detected his existence? IMO i would think it's a question of time and resources ? Would you rather spend time tracing who, how they got in? Or would you rather patch and bring up your systems quickly ?
I asked this, as we don't really have a very good incident response plan and is trying to find out the best way to handle incidents.