Incident response should leave channels an attacker may already read
Original title: Everyday channels are available in an incident, but you may not want them
Plans often cover dead email, but not chat and mail that still work while an intruder can read them.
A CSO opinion column argues that the first hours of a serious incident often stay on everyday email, Slack, Teams, documents, and video calls. If those accounts belong to responders, an attacker can read containment plans, monitor meetings, or impersonate participants while the tools still look normal. The author says fewer plans cover moving coordination out of band, separating legal analysis from operations, and avoiding shared identity, device-management, and directory dependencies.
- The author cites cases where attackers joined or recorded Zoom and Teams incident bridges.
- Backup tools that share identity, MDM, or admin credentials remain a single point of failure.
- Participant checks cannot rely on the email or calendar accounts under investigation.
- Responders may need non-corporate devices if laptops must be disconnected.
From the original article
6 min read at csoonline.com
The first hours after a serious cyber incident are filled with activity. Security starts investigating, IT works to contain the impact, legal begins assessing potential obligations, and executives want to know what happened and what the company is doing about it. Most teams rely on the same tools they use every day to coordinate that work, which usually means email, Slack, Teams, shared documents and video calls.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.