A reactive measure is a cybersecurity action taken after an incident to limit damage and restore normal operations. It forms one half of a balanced incident response approach alongside proactive prevention. section 9.1
Common reactive measures include:
- Containment, such as isolating compromised endpoints or blocking suspicious IP addresses. section 9.1
- Forensic investigation, remediation, and post-incident review to understand the breach, restore operations, and strengthen future defenses. section 9.1
Automated containment
An endpoint detection and response system detects abnormal behavior, quarantines an infected system, or rolls back malicious changes. These actions reduce dwell time while recovery and later review proceed. section 9.1
Figure 9.1 Steps to develop a comprehensive incident response plan
Use the incident response plan development steps to place containment, investigation, remediation, and review within an organized recovery process. section 9.1
