
Incident response should leave channels an attacker may already read
Plans often cover dead email, but not chat and mail that still work while an intruder can read them.
2 stories, newest first · one card per story

Plans often cover dead email, but not chat and mail that still work while an intruder can read them.

Unit 42 explains how attackers abuse trusted enterprise communication and collaboration channels for identity phishing and credential theft, and outlines defenses.
Today 1.5K readers · 2.4K views · 754 reads · all time 189K views