We are containing a security incident and need a rule changed in minutes. Then what?

Most of the time, waiting on a firewall change is an irritation. During an incident it is the difference between one compromised machine and twenty.

What containment actually requires, in the first fifteen minutes:

• Isolating a machine so it cannot reach the rest of the network or the internet, while leaving it powered on, because turning it off destroys evidence and sometimes the only copy of the encryption key.
• Blocking an address or a destination that something inside your network is talking to.
• Cutting a remote access path that is being used right now.
• Occasionally, pulling a site off the internet entirely for a short period while you work out what is happening.

Every one of those is a firewall or network change, and the value of making it decays by the minute. Ransomware moving through a network does not pause while a request is triaged.

So the question to ask before you ever need it: who can make an emergency network change, how fast, and at three in the morning? If the answer involves opening a ticket, that is worth knowing now rather than during the event. And if the answer is that you can do it yourself, confirm that somebody in your business actually has that access and knows how, rather than it being theoretically available.

What we do. A suspected active incident is critical and carries our one hour response commitment, and in practice containment steps start as soon as we are on the call. For clients with after hours coverage written into the agreement, that applies outside our standard Monday to Friday, 8 AM to 5 PM Eastern hours too. We would rather be called at 2am about something that turns out to be nothing than hear about it at 8am.

The related point about split responsibility. If one company manages your firewall and another manages your computers and your Microsoft 365, an incident forces them to coordinate while the clock runs. That is survivable with a plan agreed in advance and it is genuinely difficult without one. If you are going to split it, agree beforehand who declares an incident, who can authorize a containment change, and how they reach each other out of hours. Write it down. The time to find out that two vendors have never spoken is not while something is spreading.