3.3.1. Contain the incident—halt the DoS if it has not