When should a computer be isolated from the network?¶

A computer should be isolated when continued connectivity creates a specific and credible risk that outweighs the evidential or operational value of leaving it connected.

Why this matters¶

The dangerous assumption is that every suspected compromise requires immediate disconnection. Isolation may stop remote access, data theft, malware communication or further harm, but it may also end live sessions, interrupt logging and remove visibility of what is happening.

What to record and do¶

Before isolating, record the screen, network indicators, cables, active applications, remote sessions, visible users and any alerts.

Identify the actual risk. Is there evidence of ongoing exfiltration, remote control, destructive activity, lateral movement or continuing fraud?

Consider what the connection is supporting. The computer may be using cloud applications, remote storage, authentication services, business systems or live monitoring.

Use the narrowest effective method. One network interface, account or session may be isolated without disconnecting the entire computer or wider network.

Where the computer is part of an active cyber incident, involve incident-response, network and forensic specialists quickly.

Do not disconnect simply to “make it safe” without understanding the likely consequence.

If urgent harm requires immediate isolation, capture the visible state first where possible and document why delay was not reasonable.

Record the exact method used, time, person responsible and every observed change.

Record whether the computer has more than one network interface, because disconnecting Ethernet may leave Wi-Fi or mobile connectivity active. Note any central logging, remote administration or security monitoring that may stop when the connection is removed.

Operational takeaway¶

Isolate a computer only where a defined connectivity risk justifies it, after preserving the live state and considering what sessions, logs or services the action may remove.