Incident isolation and containment approach

Question

In incident response, there are commonly two approaches to isolation and containment after a genuine incident is reported.

1. Compromised systems are disabled or disconnected but operations carries on by reverting to a redundant system until the incident is solved, or disconnected/disabled temporarily until the incident is resolved
2. Compromised systems are not disabled or disconnected and normal operation carries on? But spend time to trace hackers and collect evidence??

In both approach, there are suggestions by experts that disconnection is not advisable because of forensics reasons. If so, then what is the best way to isolate/contain and incident so that it won't spread further and at the same time I don't let the hacker know we have already detected his existence? IMO i would think it's a question of time and resources ? Would you rather spend time tracing who, how they got in? Or would you rather patch and bring up your systems quickly ?

I asked this, as we don't really have a very good incident response plan and is trying to find out the best way to handle incidents.

Answer 1

In my opinion the response should be aligned with your business. It depends on what you value more if confidentiality, integrity, availability or traceability.

If availability or traceability are the most important: do not shutdown the systems. Design a procedure to gather forensic evidences as soon as possible and execute it when needed.

If confidentiality or integrity are the most important: shutdown the systems, extract forensic images from the disks and perform forensic analysis with what you have there.