Containment for Beginners
RCCE students will learn incident containment strategies including network isolation, account suspension, system quarantine, and threat neutralization during active security incidents. RCCE students will learn to make rapid containment decisions that balance security with business continuity, implement network-level containment using firewall rules and VLAN isolation, execute host-level containment through endpoint isolation and process termination, contain compromised accounts through credential reset and session revocation, document containment actions for forensic and legal purposes, and coordinate containment activities across distributed teams and environments. Designed for students with no prior experience in this area, this course builds knowledge from the ground up with clear explanations, guided demonstrations, and progressive skill-building. Starting from foundational concepts, RCCE students will learn core concepts through practical examples that connect theory to real-world security operations. By completion, students will have the foundational knowledge and hands-on confidence needed to contribute in professional cybersecurity roles.
- Security Engineers building defensive controls
- Security Analysts and Blue Team members
- Systems Administrators with security responsibilities
- GRC and Risk Professionals supporting controls
- Professionals implementing Containment for Beginners
- Execute hands-on tasks for bootcamp module
- Execute hands-on tasks for learning objectives
- Execute hands-on tasks for rapid containment decisions
- Execute hands-on tasks for host-level containment — covering Network-Level Containment.
- Execute hands-on tasks for what is incident containment?
- Execute hands-on tasks for key principles — covering Actions taken to limit incident scope, Speed: contain before spread.
- Execute hands-on tasks for → lessons learned
- Execute hands-on tasks for containment decision framework
- Execute hands-on tasks for security priority — covering Continuity Priority, Find the Right Balance for Each Incident.
- Explain Network-Level Containment Overview fundamentals
- Execute hands-on tasks for network containment methods
- Execute hands-on tasks for firewall rules
| Module 01 | Bootcamp Module |
| Module 02 | Learning Objectives |
| Module 03 | Rapid Containment Decisions |
| Module 04 | Host-Level Containment |
| Module 05 | What Is Incident Containment? |
| Module 06 | Key Principles |
| Module 07 | → Lessons Learned |
| Module 08 | Containment Decision Framework |
| Module 09 | Security Priority |
| Module 10 | Network-Level Containment Overview |
| Module 11 | Network Containment Methods |
| Module 12 | Firewall Rules |
| Module 13 | Firewall-Based Containment |
| Module 14 | Block Rules |
All hands-on labs run on Rocheston Rose X OS. Students practice containment for beginners by implementing the controls discussed in class, with a focus on real-world deployment, monitoring, and validation.
- Lab 1: Execute hands-on tasks for bootcamp module
- Lab 2: Execute hands-on tasks for learning objectives
- Lab 3: Execute hands-on tasks for rapid containment decisions
- Lab 4: Execute hands-on tasks for host-level containment
- Lab 5: Execute hands-on tasks for what is incident containment?
Upon successful completion of this course, students will receive an official RCCE Course Completion Certificate for Containment for Beginners, verifiable through the Rocheston certification portal.
- Full access to all course materials and slide decks
- Hands-on lab access on Rocheston Rose X OS environment
- Access to Rocheston CyberNotes
- Access to Rocheston Zelfire — EDR/XDR SIEM platform
- Access to Rocheston Raven — online cyber range exercise platform
- Access to Rocheston Vulnerability Vines AI