What is incident containment and which two strategies can achieve it in a cyber-physical system?

• A. Containment is the process of restoring systems after an incident.
• B. Containment involves legal actions against attackers.
• C. Containment limits the spread of a breach; strategies include patching all systems.
• D. Containment limits the spread of breach; strategies: network isolation of affected segments; kill-switches in ICS.

Answer: (D)

Containment is about stopping the breach from spreading and protecting critical control and safety functions in a cyber-physical system. In practice, this means actions taken during an incident to limit how far the attacker can move and how much of the system is affected, so you don’t trigger cascading failures in the physical layer.

The two effective containment strategies are: first, network isolation of affected segments. By quickly separating the compromised portion of the network from the rest, you prevent the attacker from reaching additional devices or control loops, containing the intrusion to a bounded area. Second, kill-switches in ICS. These are rapid shutdown or safe-state mechanisms that can be activated to bring equipment to a non-operational, safe condition, halting processes that could be exploited or cause harm if the breach continues. Together, these approaches confine the incident and protect safety-critical operations while responders investigate and remediate.

Patching all systems is a preventive or corrective measure aimed at closing vulnerabilities and reducing future risk, not an immediate containment action during an ongoing incident. Likewise, restoring systems after an incident is part of recovery, and legal actions address governance or consequence management rather than technical containment.