Everyday channels are available in an incident, but you may not want them

Publisher excerpt From CSO Online

The first hours after a serious cyber incident are filled with activity. Security starts investigating, IT works to contain the impact, legal begins assessing potential obligations, and executives want to know what happened and what the company is doing about it. Most teams rely on the same tools they use every day to coordinate that work, which usually means email, Slack, Teams, shared documents and video calls. Coordination gets much more complicated when the company’s email or collaboration environment is part of the incident. Email may still work, employees may still be able to join meetings, and nothing on the surface may suggest that the organization has lost control of its communications. Meanwhile, an attacker with access to accounts used by responders may read the team’s messages, monitor containment plans or impersonate someone involved in the response. When that happens, the company faces a second crisis inside the first. The systems people depend on to manage the incident can no longer be trusted. After more than two decades in the privacy and breach space, and in my weekly conversations with security and legal teams, I see the same pattern. Most incident response plans account for email or collaboration tools becoming unavailable. Teams have phone trees, personal contact information and backup conference lines. They know whom they need to call. What they often lack is a systematic approach for the harder case. Far fewer plans address the more ambiguous situat…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.