Shutting down servers is an emergency decision that trades business continuity for security, and is appropriate when the losses from an attack are judged to far outweigh the impact of a temporary outage.