Red button is common in machinery or plant equipment to halt the operation immediately for safety reason.
But in cyber world, red button is rare. We deploy cyber protection based on what we know. For those cyber threats that we could never think of, the efficient action in the IR playbook shall simply disconnect the network of the computer system as containment. To achieve this, identify the core network switches with ingress/egress points and install a “kill switch” (red button) for these network switch(es) to turn off power.
The pitfalls are:
- Introduce points of failure
- Conduct regular tests to ensure it works as expected
There is no free lunch …