Drill: quarantine a compromised workload
Abstract
A drill for a suspected compromise: triage, take it out of service, bind a deny-everything tag to that one machine rather than its whole pool, confirm the deny, snapshot it as evidence, and hand it to investigation while a clean build replaces it.
Containment is precise or it is an outage: quarantine the machine, not the fleet.
Its figure in the paper: § III.B →
Setting up the instrument…
Declared limits
- Timings are described in plain terms; the real runbook stays private.
- Generic and illustrative throughout: the behaviour is shown, the internals of the systems it is drawn from are not.
Instruments beside it in § III.B
Every attack in the laboratory, on one page: try to break all of it →
Everything you did in the laboratory, in one chain you can rewind: the notebook →