Infected laptop on the VPN: contain the session, not the route
Split tunnel changes whose address the destination sees, not the infection. Three conditions decide the order of containment, evidence and readmission.
Endpoint abuse reports usually arrive with a proposed shortcut attached: put the laptop on split tunnel so the address seen at the destination changes. That changes an observation, not an infection. The device keeps whatever internal access its session already holds, and the malware keeps running on hardware nobody has examined. Three conditions should set the order of work: what the device credentials still reach, whether that access is in use right now, and what evidence a fast wipe would destroy.
First condition: what the credentials still reach
A revoked or disabled account is only half the answer, because a client may hold a certificate, a cached token, a saved pre-shared key or a machine credential that survives a password change. Map every authenticator the profile uses before choosing an action. Then check whether the product terminates sessions on revocation or only refuses new ones.
Where the gateway supports it, end the session explicitly and confirm from the accounting or session table that it went away. A change that only affects the next login leaves the current flow running.
Second condition: is the access in use right now
Correlate the alert window with the actual session, the assigned tunnel address and the device identity. A shared corporate exit represents everyone behind it, so an observed public address cannot identify which endpoint produced a flow. That correlation is the step people skip when the alert looks obvious.
Use the records the deployed service really collects, such as accounting start and stop events that tie a session to an identity and an address. If those records are incomplete, say so in the report rather than filling the gap with the firewall view. A report that separates evidence from inference survives review better than one that does not.
Third condition: what has to survive the response
Containment that destroys the only copy of the evidence is a second incident. Preserve the relevant logs, the session records and the endpoint artefacts through the process that owns retention and access. Do not paste an export into a ticket that the whole support team can read.
Then decide how much of the endpoint to rebuild with the incident owner. Quarantine limits damage while the scope is established, and it also limits what the responders can still observe, so those two goals have to be traded deliberately.
What containment actually looks like
Effective containment is layered: network quarantine at the access layer, revocation of every authenticator the profile uses, explicit session termination, and restriction of the internal permissions the account held. Any one of those alone leaves a path open.
| Condition | Act first | Defer |
|---|---|---|
| Credentials reach internal systems | Revoke and terminate the session | Endpoint rebuild |
| Access visibly in use | Quarantine, then scope the reach | Rotation of unrelated accounts |
| Evidence still on the device | Preserve artefacts, restrict read access | Reimage |
Order matters more than completeness in the first hour. Revocation before a wipe gives you a chance to watch the client react, and session termination before revocation shows whether the gateway honours it at all. Record which control produced which effect.
Routing is a service decision, not a containment tool
Split tunnel reduces what the office exit carries, and full tunnel puts more traffic through a chosen inspection path. Neither mode certifies the endpoint, and neither revokes a credential.
A full-tunnel design is worth having when the inspection path is equipped to detect and to act, which is a different project from the incident in front of you. Switching modes mid-incident mostly produces confusion about which logs belong to which behaviour. Decide the mode afterwards, with the service's owner and the monitoring team in the room.
Conditions for readmission
Write the readmission conditions down before the device comes back: the remediation state that must be verified, the status of every exposed credential, the endpoint controls that must be reporting, and the minimum permissions the account needs rather than the ones it happened to have. Sort them into must and nice-to-have. The original permission set is not a requirement.
A clean scan is one input, and a successful login proves only that the authentication workflow ran. Restore access in stages, watching the session and the resource usage under the approved plan. Name the owner of whatever restriction remains. If the abuse reached a partner through the office exit, tell that partner through the channel the contract requires instead of waiting for them to notice.