Nedved is an IT Security Manager of a bank in his country. One day. he found out that there is a security bre ch to his company's email server based on analysis of a suspicious connection from the ema

Leaving the server connected while contacting IR allows the active malicious connection to continue unimpeded, enabling ongoing data exfiltration during the response delay.

Blocking the IP at the firewall addresses only one known vector but does not stop any other malicious processes or backdoors already running on the compromised server itself.

Disconnecting the email server from the network is the first containment action, immediately stopping active data exfiltration to the suspicious IP and preventing lateral movement to other internal systems. Containment must occur before formal IR team engagement to limit the breach's blast radius while preserving evidence. This aligns with NIST SP 800-61 guidance that initial containment is the responsibility of the person who discovers the incident.

Migrating to a backup server does not isolate the breached server, allowing the attacker to retain their foothold and continue operating from the original compromised system.