Containing a Security Incident Across a Franchise Network

Containment means structuring identity, network and access so that an attacker who reaches one location cannot move sideways into shared systems or other sites. It is a design property of the network, not a reaction that begins after an incident is detected. The containment you have during an incident is whatever you designed before it.

When locations share identity, accounts or network paths, a compromise at one site can authenticate into systems the other sites use. Shared or generic accounts, flat networks and unmanaged devices all create paths an attacker can follow. The more connected the sites are without separation, the further a single compromise travels.

Responsibility for the breach itself may sit with the site, but the reputational consequence attaches to the brand regardless of ownership structure. Customers and the press do not distinguish between locations, and head office is typically drawn into the response whether or not it caused the incident. Planning for that reality is a head-office decision.

The first hour is for isolating the affected site from shared systems, preserving evidence and notifying the people named in the response plan. It is not for investigating root cause or assigning blame. The plan should name who isolates, who communicates and who confirms containment so nobody is improvising under pressure.

The response plan should name an internal lead, an IT or security contact and an external communications owner, with a defined order so the first call is not a debate. The plan should also identify when to involve the insurer or broker and when to seek legal advice. Deciding the call order during an incident is slower and less reliable than deciding it beforehand.

Whether a policy responds depends on its terms, the scope of cover and how the incident is classified, so the answer should be confirmed with the insurer or broker before anything happens. Head office should not assume that a policy held at site level extends to the network. Reviewing cover with the broker is a planning task, not a post-incident task.

If the network is designed with separation between sites, unaffected locations can continue operating while the compromised site is isolated. Without that separation, isolating one site may require disconnecting shared systems that others depend on. The ability to keep trading during an incident is a direct result of how the network was built.

Separation means each site has its own identity boundary, its own device enrolment and its own network segment, with shared systems gated by conditional access rather than open to anything that authenticates. It does not mean every site is fully independent. It means a compromise at one site hits a boundary before it reaches the next.

Accounts used by multiple people have no individual accountability, cannot be disabled when one person leaves and are rarely rotated, which makes them a persistent target. If a shared account is compromised, every site that uses it is exposed. Individual accounts with multi-factor authentication are harder to compromise and easier to remove.

Access should be removed immediately and the account disabled, not left for someone to remember later. A departure process that is owned centrally, not by the site, ensures accounts do not outlive the people who used them. The longer a departed person's account stays active, the longer it is a valid credential an attacker can use.

Centralised monitoring and device management give head office visibility of security posture across every location without requiring day-to-day involvement at each site. The systems report their own state, so head office sees the position from a dashboard rather than from phone calls. Visibility is a function of the tools, not of head-office headcount.

Multi-factor authentication is one of the most effective controls an attacker has to defeat, but it does not replace device management, patching, network separation or monitoring. A network that relies on a single control has a single point of failure. Multi-factor authentication is part of a layered position, not the whole of it.

Franchisees should know what head office monitors, what they are expected to manage themselves, who to call if they suspect something and what not to do. A short, clear briefing is more useful than a long policy document most will not read. The goal is that a franchisee's first call is to the response plan, not to a search engine.

A tabletop exercise, where the response team works through a simulated scenario without touching live systems, tests the plan without affecting any location. It reveals who is unsure of their role, where the plan has gaps and which contacts are out of date. Testing the plan for the first time during a real incident is the most expensive way to find its weaknesses.

Start with visibility and separation, because you cannot contain what you cannot see and you cannot isolate what is not separated. Map which sites have managed security, which accounts are shared and which devices are enrolled. A plan built on that picture is more useful than a plan written before anyone knows the current state.