Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control PlanCP-14Compromised Device Isolation

Proposed Control Plan. Subject to technical and publication approval.

One affected device. A defined physical boundary.

CP-14 Compromised Device Isolation Control Plan icon

Physically isolate one affected device from the network.

Plan
CP-14
Purpose
Compromised Device Isolation
Selected connections
6
Modules
Fracture · Isolate · Execute · Validate · Unlink · Lock
Scope
One identified endpoint or appliance and its mapped physical connections. Segment-wide effects require explicit approval.

What is at stake

Why compromised device isolation matters.

A compromised endpoint can retain network reach while responders investigate.

Persistent device connectivityThe device network connections can remain available beyond the approved need.
Device service lossThe device loses the services carried by those connections. Other routes need separate treatment.
Incident ownershipName the incident owner and the conditions for a connection change.
Device connection checksCheck the observed state of the device network connections, including parallel routes.

The problem today

Where you are IP connected today.

CP-14 reviews six IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner.

6IP-connected paths reviewed
6Risks to agree with owners
6Control modules applied
  1. Risk 1Device primary Ethernet interface to access switch

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Connected

  2. Risk 2Device secondary Ethernet interface to network

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Connected

  3. Risk 3Admin gateway to device management interface

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected

  4. Risk 4Shared device gateway to business service network

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Connected

  5. Risk 5Responder staging network to evidence workstation

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected

  6. Risk 6Device dock Ethernet interface to access switch

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Connected

Matching industry Blueprints

BP-08 · healthcare

What Firevault changes

What changes with this Plan.

Physically isolate one affected device from the network at its identified boundaries.

Connection Agreed normal state Control action
Device primary Ethernet interface to access switch Connected Fracture withdraws the affected device connection.
Device secondary Ethernet interface to network Connected Isolate operates the registered device interfaces as one group.
Admin gateway to device management interface Disconnected Execute closes the device management connection.
Shared device gateway to business service network Connected Fracture withdraws the shared device service boundary.
Responder staging network to evidence workstation Disconnected Transfer governs responder artefacts; Execute closes the evidence crossing.
Device dock Ethernet interface to access switch Connected Isolate withdraws the dock path with other registered device conduits.

Threat detection, malware removal and independent wireless, cellular or cloud routes unless separately addressed.

Control in Action

Compromised Device Isolation: see the selected path change.

Physically isolate one affected device from the network at its identified boundaries.

Control in Action

Stage

Before agreed physical control

A compromised endpoint can retain network reach while responders investigate.Connected routes require review. Discovery checks your real dependencies.

0reached by the attack
10still running

Physical crossings

  • Device primary Ethernet interface to access switchAlways connected
  • Device secondary Ethernet interface to networkAlways connected
  • Admin gateway to device management interfaceAlways connected
  • Shared device gateway to business service networkAlways connected
  • Recovery access (OSS)Not in place
  1. FBFracture · Review the purpose and ownership of each selected connection.

Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate.

The modules involved

The Control modules behind this Plan.

In CP-14: withdraws the identified device crossing. In CP-14: groups the affected device boundaries where the design requires it. In CP-14: applies the approved device containment or return action.

CP-14Compromised Device Isolation

Z0Requesting environment
Z1Protected systems
Z2Related operations
Held in Offline Secure Storage®Selected recovery material, held separately
Out-of-band command path

This Control Plan

Physically isolate one affected device from the network at its identified boundaries.

Primary modules: Fracture, Isolate, Execute, Validate, Unlink and Lock.

Read the operational detail

Module in this plan

Fracture module icon

Fracture

Controls the path

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Explore the Fracture module

Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery.

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

The Control Plan specification

Each selected connection, written down.

Physically isolate one affected device from the network at its identified boundaries.

Device primary Ethernet interface to access switchConnected
Normal state
Connected
Authorisation
1 · Approved endpoint alert identifies this device as compromised
Module action
Fracture withdraws the affected device connection.
Business effect
Device access to shared applications and network storage stops.
Failure behaviour
Disconnected on fault; the device remains without its primary network path.
Device secondary Ethernet interface to networkConnected
Normal state
Connected
Authorisation
1 · The same validated device alert requires all wired paths withdrawn
Module action
Isolate operates the registered device interfaces as one group.
Business effect
Secondary wired access stops, preventing this route from retaining connectivity.
Failure behaviour
Disconnected on power loss; verify secondary port state independently.
Admin gateway to device management interfaceDisconnected
Normal state
Disconnected
Authorisation
1 · Device compromise alert invalidates the approved management session
Module action
Execute closes the device management connection.
Business effect
Remote administration stops; local responder access remains separately scoped.
Failure behaviour
Disconnected on fault; use the approved local response procedure.
Shared device gateway to business service networkConnected
Normal state
Connected
Authorisation
2 · Incident owner accepts shared service impact after device compromise
Module action
Fracture withdraws the shared device service boundary.
Business effect
All users lose the shared device service, not just the affected session.
Failure behaviour
Designed to stay connected on fault; shared service availability leaves residual exposure.
Responder staging network to evidence workstationDisconnected
Normal state
Disconnected
Authorisation
1 · Approved evidence collection completes or collection authority is withdrawn
Module action
Transfer governs responder artefacts; Execute closes the evidence crossing.
Business effect
Remote evidence collection stops; already collected artefacts remain.
Failure behaviour
Disconnected on fault; verify evidence completeness before resuming collection.
Device dock Ethernet interface to access switchConnected
Normal state
Connected
Authorisation
1 · Validated device alert includes the registered dock interface
Module action
Isolate withdraws the dock path with other registered device conduits.
Business effect
Dock network services stop; unrelated dock peripherals are outside scope.
Failure behaviour
Disconnected on power loss; check other adapters before declaring isolation.

Threat detection, malware removal and independent wireless, cellular or cloud routes unless separately addressed.

Operational runbook

Who does what, and when.

What happens under normal conditions, during approved work, when an incident is detected and when connections are restored.

StageWhat happensWho decidesOn record
1Normal operationAgreed states held

Physically isolate one affected device from the network at its identified boundaries. Each selected connection sits at its agreed normal state.

Set in the Plan, signed off by your operational, security and continuity leads.

Connection states, continuously.

2Approved workBooked, bounded access

Fracture withdraws the affected device connection.ValidateUnlinkLock

The named owner approves each opening in advance.

Request, approval, opening and closure.

3Incident detectedAct on the alert

Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute

Pre-authorised in the Plan. The incident owner is told at once.

The alert and the action taken.

4Controlled responseChange the agreed crossings

Physically isolate one affected device from the network at its identified boundaries.FractureIsolate

Automatic only for the crossings you agreed. Anything else needs the incident owner.

Each action, timestamped.

5ReconnectionCheck before reopening

A physical boundary does not prove task completion or device remediation. Apply the agreed evidence and owner checks.

The operational owner authorises each reconnection.

Each check and each reconnection.

Threat detection, malware removal and independent wireless, cellular or cloud routes unless separately addressed.

Engineering and integration

Fit the control around your existing environment.

One identified endpoint or appliance and its mapped physical connections. Segment-wide effects require explicit approval.

Map the complete boundaryConfirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope.
Agree an independent command routeConfirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes.
Test the effect, not just the commandVerify the observed link state, service dependencies and failure behaviour in an agreed test window.

Testing and evidence

Prove the selected connection before relying on it.

Agree acceptance criteria with the service owner, then retain the observed results.

Normal serviceCheck the agreed service state and alternate paths.
Controlled changeVerify approved opening, closure and the operational impact.
Recovery and failureTest reconnection checks, loss of power and loss of the command route.

Resilience and recovery

Offline Secure Storage®

OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

A physical boundary does not prove task completion or device remediation. Apply the agreed evidence and owner checks.

Explore Offline Secure Storage

Frameworks and limitations

Support your obligations. Keep the boundaries clear.

Threat detection, malware removal and independent wireless, cellular or cloud routes unless separately addressed.

What this addressesPhysically isolate one affected device from the network at its identified boundaries.
What it does not replaceThreat detection, malware removal and independent wireless, cellular or cloud routes unless separately addressed.
Evidence agreed for the deploymentSpecify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design.

Build your Control Plan

Start with the connections you would cut first.

Use these proposed entries to prepare a discovery discussion. Identify connection owners, alternatives, approved states and unresolved dependencies. Selections are not deployment instructions.

Questions worth asking

Before you rely on CP-14.

Practical questions for the people who own these connections.

Physically isolate one affected device from the network at its identified boundaries.

One identified endpoint or appliance and its mapped physical connections. Segment-wide effects require explicit approval.

Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path.

Threat detection, malware removal and independent wireless, cellular or cloud routes unless separately addressed.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Use these proposed entries to prepare a discovery discussion. Identify connection owners, alternatives, approved states and unresolved dependencies. Selections are not deployment instructions.

Your next step

Take the next step with compromised device isolation.

Use these proposed entries to prepare a discovery discussion. Identify connection owners, alternatives, approved states and unresolved dependencies. Selections are not deployment instructions.

Book a briefing

Prefer to talk first? Speak to the team