Okuzeka
Cybersecurity vocabulary · Incident Response

Containment

Meaning in cybersecurity, with examples

/kənˈteɪnmənt/nounCommon term

In cybersecurity, containment means: The stage of incident response in which the team stops an attack from spreading or causing more damage, for example by isolating infected machines.

In Turkish: sınırlama, kontrol altına alma, yayılımı engelleme

How it is used

Part of the usual incident response sequence: detection, containment, eradication, recovery. Typical containment actions are isolating hosts, disabling accounts, resetting credentials and blocking IP addresses. The verb is 'contain': 'we contained the incident'.

Example sentences

  1. Containment came first: we isolated the three infected laptops before starting the investigation.

  2. Short-term containment bought us time to rebuild the server safely.

Common collocations

  • containment measures
  • short-term containment
  • contain an incident
  • containment strategy
  • incidentAn event that threatens or harms the confidentiality, integrity or availability of systems or data, such as a malware infection or an unauthorised login.
  • playbookA written, step-by-step guide that tells a security team how to handle a specific type of alert or incident, such as phishing or ransomware.
  • remediationThe work of fixing a security problem at its source, such as applying a patch, changing a configuration or rewriting vulnerable code.
  • disaster recoveryThe plans and processes for restoring IT systems and data after a serious disruption, such as a ransomware attack, a fire or a data-centre failure.

This word in other fields

The same English word can have a different meaning in another field:

More terms: Incident Response

Practise with graded reading

Reading at the right level is the fastest way to make new words stick. Pick free English books by level: