Fast Facts
-
Functional doesn’t mean trustworthy: If attackers may control responders’ email or collaboration accounts, they could monitor plans or impersonate team members.
-
Move response coordination out of band: Don’t discuss containment or sensitive decisions in channels under investigation; assume prior messages may have been exposed.
-
Design the fallback before an incident: Define activation triggers and decision-makers, verify identities independently, and check that backup channels, devices and contacts don’t share compromised dependencies.
- Rehearse the switch: Test whether security, legal, executives and outside partners can quickly establish a verified response group and keep operating without affected systems.
Key Challenge
A CSO contributor with more than 20 years of experience in privacy and data breaches warns that cyberattackers may compromise the email and collaboration accounts used by a company’s incident-response team. The services may still appear to work. However, attackers could be reading messages, tracking containment plans, or impersonating responders. As a result, security staff, lawyers, executives, and outside advisers may unknowingly share sensitive information with the intruder.
The problem arises because many companies rely on familiar tools such as email, Teams, or Slack during a crisis, even when those systems may be part of the breach. The author says organizations should prepare a separate, verified communications channel and practice moving their response to it. The excerpt does not identify the contributor by name or describe a specific company breach; it presents a risk scenario and recommendations for preventing a second crisis.
Risks Involved
This issue can affect any business: during an incident, everyday channels such as email, chat, or phone may still work, yet be too slow, overloaded, insecure, or difficult to monitor. As a result, staff may miss instructions, act on conflicting information, or share sensitive details in the wrong place. Meanwhile, response efforts stall and service disruptions last longer. Even a brief delay can cost revenue, damage customer trust, and create legal or compliance risks. Therefore, businesses need incident-specific communication methods that remain clear, secure, and dependable when routine channels are no longer suitable.
Possible Remediation Steps
Timely remediation protects incident coordination from compromised or unreliable everyday channels.
Secure Communications
- Switch to preapproved, out-of-band channels—such as a dedicated incident bridge or secure messaging platform—when routine email, chat, or phone systems may be affected.
- Verify participants and instructions through a separate trusted method; do not rely on contact details or links supplied through a suspect channel.
- Restrict access to incident communications, use strong authentication, and share only information each participant needs.
- If a channel may be compromised, suspend its use, preserve relevant records, and notify the incident lead and security team.
- Reset exposed credentials, revoke unauthorized sessions, and restore the channel only after it has been assessed and secured.
- Document communication decisions and test backup channels regularly, consistent with NIST CSF preparation, response, and recovery practices.
Advance Your Cyber Knowledge
Discover cutting-edge developments in Emerging Tech and industry Insights.
Learn more about global cybersecurity standards through the NIST Cybersecurity Framework.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
