Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control BlueprintCP-01

Stop Kill-Chain Ransomware

A compromised laptop should not become a route to your databases, business records and recovery assets. Put a physical boundary in the way of ransomware spreading.

Blueprint
CP-01
Primary modules
  • Firebreak
  • Isolate
  • Execute
Supporting
  • Unlink
  • Lock
Where it fits
Lateral movement prevention across IT and OT
CP-01 Stop Kill-Chain Ransomware, as drawnIllustration
Zone 0User and endpoint zoneWhere the foothold typically lands
Boundary 1
  • Isolate
  • Lock
Scoped
Named, scoped reach into core services.
Zone 1Core IT servicesIdentity, file, mail, collaboration
Boundary 2
  • Firebreak
  • Execute
  • Unlink
Severed
Severed by default. Restored only as an approved Execute event.
Zone 2Crown-jewel systemsDatabase, ERP, core record systems
Held offlineOffline recovery vaultTamper-evident copies, not reachable on the live network.Offline

Out-of-band command pathManagement Ethernet, cellular SMS or an authenticated API, off the production network.

The sequenceStep through how the modules work together, as the Blueprint sets them out.

The pattern

Break the route from foothold to critical records.

What it does

Ransomware rarely stays where it first arrives. A compromised endpoint can provide access to shared services, identities and the systems your organisation depends on. CP-01 separates those stages so a foothold does not automatically inherit a path to the next environment.

Where it fits

Use this pattern where everyday IT connects to higher-value systems: financial records, clinical services, public-sector databases or defence information. Identify the crossings that an attacker would need, rather than treating every device as one security boundary.

Control for ransomware

Zone by zone

How CP-01 stops the kill chain.

Follow the attack route from a user device through shared services to the records that matter most.

  1. Zone 0

    User and endpoint zone

    User devices are the first exposure point in this pattern. Their access should not imply unrestricted reach to core services.

  2. Boundary 1

    Scoped

    Limit the endpoint-to-services crossing to the named purpose and identity, rather than inheriting the whole network.

    • IsolateZone boundary. Primary in CP-01
    • LockNamed access. Supporting in CP-01
  3. Zone 1

    Core IT services

    Identity, email and collaboration services can become stepping stones. Treat their connections to critical systems as a separate decision.

  4. Boundary 2

    Severed

    Keep the route to critical records disconnected except for an approved event; close it again when the agreed threat condition occurs.

    • FirebreakPhysical sever. Primary in CP-01
    • ExecuteTrigger, act, terminate. Primary in CP-01
    • UnlinkRemove trust. Supporting in CP-01
  5. Zone 2

    Crown-jewel systems

    ERP, databases and core records need their own boundary, not just the same protection as a staff laptop.

  6. Offline

    Offline recovery vault

    Keep selected recovery copies in Offline Secure Storage®, separately from the production attack route. This supports recovery planning; it does not establish that a copy is clean.

    Offline Secure Storage®

Bill of modules

Firebreak, Isolate and Execute lead. Unlink and Lock support.

The first three modules interrupt the spread. Unlink and Lock address the dependencies and identities that could otherwise extend an attacker’s reach.

Module Layer In CP-01 Where it sits What it does here
Firebreak Control the path Primary Boundary 2 Disconnects the crossing from core IT to critical records when the ransomware response calls for physical separation.
Isolate Control the path Primary Boundary 1 Keeps the affected endpoint or service zone apart from the environments it must not reach.
Execute Control the path Primary Boundary 2 Applies the pre-agreed ransomware response to the selected boundary after an authorised signal.
Unlink Protect the asset Supporting Boundary 2 Removes standing dependencies that could give a compromised service continuing reach to critical systems.
Lock Protect the asset Supporting Boundary 1 Limits access through the scoped crossing to the identities and roles approved for that work.

For the ransomware boundary, Firebreak® supplies the physical disconnect within Control by Firevault. It controls the chosen crossing, not every route an attacker might use.Explore Firebreak®

All nine modules

Versus the alternatives

An endpoint response is not the same as a closed crossing.

Keep detection and response in place. Compare how each approach handles the specific route from compromised IT to critical records.

Question Detect and respond Manual shutdown CP-01
Threat decision Monitoring identifies suspicious activity Staff interpret the incident before disconnecting Existing detection authorises the agreed boundary action
Reach beyond the endpoint Software containment depends on the deployed response A cable break stops the selected connection Firebreak disconnects the defined route to critical records
Business interruption Response may target individual hosts Disconnection needs an identified cable or segment Isolate limits the action to the planned zone
Standing dependencies Connections remain unless policy removes them Other connections need separate investigation Unlink addresses dependencies identified in the design
Recovery material Endpoint tools do not create a separate recovery tier Disconnected cabling does not preserve a recovery copy Recovery assets are protected separately through OSS
Return to service Follow the incident response workflow Reconnect after an authorised physical intervention Reopen the boundary only after the agreed checks

Questions

Ransomware questions worth settling now.

No. It limits the connections available for spread across the designed boundaries. Your incident response team still investigates, removes the compromise and checks affected systems.

Start with the records and services whose loss would stop the organisation: core databases, ERP and authoritative records. Map their required connections before deciding which crossings can be closed.

Your existing detection or authorised operator supplies the decision. Execute carries out the pre-agreed action locally. The design should specify confidence thresholds, scope and human authority.

Identity controls remain necessary. Lock narrows approved access, while Unlink removes standing dependencies. Protection depends on identifying the real routes, including those outside the selected boundary.

It should be protected separately. Offline Secure Storage provides a distinct place for selected recovery assets; the team must still validate recovery material before restoring it.

After the incident owner has checked the affected zone and approved restoration. Define that decision before an incident, rather than letting the end of an alert automatically mean the environment is safe.

All questions

Disconnect to Protect®

Put a boundary before your critical records.

Tell us which services ransomware must not reach. We will discuss the crossings, decision owners and recovery assets around them.