What are the pros and cons of isolating vs. eradicating infected systems?

When your organization faces a cyberattack, you need to act quickly and effectively to contain the threat and minimize the damage. One of the key decisions you have to make is whether to isolate or eradicate the infected systems. Both options have their pros and cons, depending on the type, scope, and severity of the incident. In this article, we will compare and contrast the advantages and disadvantages of isolating vs. eradicating infected systems, and provide some guidelines on how to choose the best strategy for your situation.

1 What is isolation?

Isolation is the process of disconnecting the infected systems from the network, or limiting their access to certain resources, to prevent the spread of malware or unauthorized access. Isolation can be done physically, by unplugging the cables or power cords, or logically, by using firewalls, access control lists, or other network tools. Isolation is usually a temporary measure, until you can analyze the systems and determine the next steps.

Add your perspective

J M.

SOC build, SOC maturity, IR TTX, SOP, runbook, playbook, 👇 DM or book a call below 👇
Report contribution
In a windows domain, built in functionality can be used to perform isolation of endpoints. Powershell tweaks to IPSEC settings are a simple way to achieve this affect.

Like
Chris W.

MSc. | GSP | GIAC x23 | Security Professional
Report contribution
Modern networks should implement a zero trust architecture that uses identify management for isolation. By building a defensible network, the mean time to respond (MTTR) can be greatly improved.

Like

2 What is eradication?

Eradication is the process of removing the malware or malicious files from the infected systems, or restoring them to a clean state. Eradication can be done by using antivirus software, deleting or quarantining the files, or wiping and reinstalling the systems. Eradication is usually a permanent measure, but it may require more time and resources than isolation.

Add your perspective

Chris W.

MSc. | GSP | GIAC x23 | Security Professional
Report contribution
Eradication can be as simple as terminating a rogue process, or ending a network session. However consideration must be given to the absence of the security controls that allow for initial compromise.

Like

3 Pros of isolation

Isolation is an effective security measure that can be implemented quickly and easily without complex tools or skills. It helps to stop or slow the spread of malware or unauthorized access, and preserve evidence of the attack. Additionally, isolation can limit the impact on other systems or data and give you more time to plan and execute your eradication strategy without compromising security or availability.

Add your perspective

4 Cons of isolation

Isolation has a few drawbacks, such as disrupting the normal operations and functions of the isolated systems, creating a false sense of security, and increasing the workload and complexity of your incident response team. Additionally, it can be bypassed or reversed by sophisticated attackers who may have alternative ways to access your network.

Add your perspective

Chris W.

MSc. | GSP | GIAC x23 | Security Professional
(edited)
Report contribution
Changes to a network configuration can disrupt C2 channels and tip off adversary. This can result in a change of tactics by a threat actor resulting in a loss of visibility. If possible, proper scoping should be done first during the identification phase. Containment is most successful when the intent, motives, and capabilities of a threat actor are known.

Like

5 Pros of eradication

Eradication offers several advantages, including eliminating malware or malicious files from infected systems, reducing the risk of reinfection or recurrence of the attack, freeing up resources and bandwidth of your network, and simplifying management and maintenance of your systems. Furthermore, eradication can improve the security and resilience of your network, enhance the efficiency and performance of your systems, and reduce the need for constant monitoring or isolation.

Add your perspective

6 Cons of eradication

Eradication has some drawbacks that should be considered, such as the time and resources required to complete the process, as well as the need for specialized tools or skills. Eradication can also destroy or overwrite evidence of an attack, leading to difficulty in investigating the root cause and indicators of compromise. Additionally, data loss or corruption can occur if the backup or restoration process is not done properly or securely. Finally, eradication can be ineffective or incomplete if malware and malicious files are not detected or removed completely, or if they have spread to other systems or locations.

Add your perspective

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

Add your perspective

What are the pros and cons of isolating vs. eradicating infected systems?

1

2

3

4

5

6

7

1 What is isolation?

2 What is eradication?

3 Pros of isolation

4 Cons of isolation

5 Pros of eradication

6 Cons of eradication

7 Here’s what else to consider

Incident Handling

Rate this article

Thanks for your feedback

More articles on Incident Handling

More relevant reading