Should compromised systems be disconnected immediately?¶

Compromised systems should not be disconnected automatically without first considering the active harm, evidential value and operational effect.

Avoid this assumption: Immediate disconnection is always the safest response. It may stop remote access, malware communication, data theft or further spread, but it may also destroy live sessions, interrupt logging and remove visibility of the attacker.

Start by defining what is happening. Is data leaving the organisation? Are systems being encrypted, altered or remotely controlled? Is the incident spreading?

Record the current screen, alerts, logged-in users, running applications, network state, time and any visible attacker activity.

Identify what depends on the system, including business services, public-safety functions, authentication, cloud access, communications and central logging.

Consider the narrowest effective action. One account, interface, device or network segment may be isolated without disconnecting everything.

Where the incident is active or the environment is complex, involve incident-response and network specialists quickly.

Do not leave a system connected merely to watch the attacker where continuing harm is unacceptable.

Likewise, do not disconnect simply to make the situation feel controlled.

If immediate disconnection is necessary, capture the visible state first where this can be done without unacceptable delay.

Record who authorised the action, the exact time, method, systems affected and every resulting change.

Do not assume disconnection has removed every access route or preserved all relevant evidence.

Operational takeaway¶

Disconnect a compromised system only where a defined active risk justifies it, after preserving the live state and choosing the narrowest effective containment measure.