Disable the affected service.  If an attacker is using a particular service to gain unauthorized access, containing the incident may include temporarily or permanently disabling the service.  For example, if the attacker is exploiting an FTP vulnerability and the unauthorized access is limited to the FTP data files, the incident could be contained by temporarily disabling the FTP service.  If the server is inadvertently running FTP, then FTP should be disabled permanently.

Eliminate the attacker’s route into the environment.  If possible, prevent the attacker from accessing nearby resources that might be the next targets while minimizing disruption of services to authorized users.  Examples include temporarily blocking incoming connections to a particular network segment or disconnecting a remote access server.

 Disable user accounts that may have been used in the attack.  The same accounts and passwords that were acquired from one system may work on other systems; therefore, the accounts may need to be disabled across the enterprise.  Handlers should also look for new user accounts that may have been created by the attacker.  Accounts should be disabled, rather than just changing passwords, until handlers determine what actions the attacker performed.