Cyber Incident Response Needs a Trusted Out-of-Band Communications Plan

When an attacker may be watching the incident response team, a working email system can be more dangerous than an obvious outage. The central challenge is trust: responders must coordinate containment, legal review and leadership updates without revealing plans to someone who may already be inside their communications.

That risk is easy to overlook because most companies prepare for familiar failures. If email stops working, employees can call one another or join a backup conference line. But compromised accounts may leave email, Slack, Teams and video meetings running as usual. A system that looks available can still be under an attacker’s control.

For companies, that creates a second crisis alongside the intrusion itself. The response team needs a way to move its work elsewhere while investigators determine which accounts, services or devices have been compromised. That channel must be ready before an incident, and the organization must know when to activate it.

Availability doesn’t establish trust

During ransomware, unavailable systems make the need for backup communications apparent. A more ambiguous case is harder to manage: an attacker gains access to accounts used by responders, but the company’s collaboration tools continue to function.

Now the team has to investigate the intrusion, remove the attacker and contain access without exposing its next steps. Meanwhile, legal needs facts to assess potential notification requirements, communications staff are preparing for customer questions, and executives expect updates. If those conversations take place in a channel the attacker can read, each one could disclose information useful to the intruder.

Responders need to answer a basic question before sharing sensitive plans: who can see the messages and join the meetings? I’m aware of cases in which attackers joined or recorded incident calls on Zoom and Teams. Familiarity makes these tools convenient for coordination, but it doesn’t establish that a particular session or account is safe.

That distinction should shape the response plan. A channel can remain technically available while being unsuitable for sensitive work. Teams need predefined conditions for treating the normal environment as untrusted, along with a practiced way to shift coordination out of it.

Assume exposed messages may resurface

Moving the response also affects how a company handles legal analysis and its record of decisions. As I discussed in my previous CSO article, adding a lawyer to a large incident channel doesn’t make every message privileged. Operational coordination and legal advice are different kinds of work; both need deliberate handling.

If an attacker has been monitoring a response channel, the company should assume that its contents have left its control. That may include containment plans, candid discussion of how the intrusion occurred and draft statements for customers. Such material could appear in an extortion demand or later in discovery.

Planning for that possibility means setting up the response structure in advance. The out-of-band channel should let teams limit participation, keep operational coordination distinct from legal analysis and maintain a clear record of decisions. That record should help establish what the company decided, who made the decision, what facts were available and why the team acted.

Legal should help design this structure before an incident. Trying to establish new rules during a crisis, while the attacker may be reading the primary channel, adds uncertainty at the moment the team has the least time to resolve it.

Map dependencies before choosing a tool

Starting with a backup messaging app can miss the main technical problem. The emergency channel may depend on the same identity service, managed devices, mobile device management tools, administrative credentials or employee directory as the system under investigation. If it does, a compromise of one shared component could undermine both routes.

Map those dependencies first. Then determine how each person will prove their identity without relying on the accounts that may be compromised. An attacker with access to email or calendars could know about an emergency meeting and use that context to impersonate a responder or executive.

The plan also needs to account for the people outside the company who may be essential to the response: outside counsel, forensic investigators, insurers and communications advisers. Keep their contact details current, decide who can approve their involvement and agree on a verification process before an incident begins.

Hardware is part of the plan, too. Responders may be told to disconnect corporate laptops, so the alternate channel should be reachable from devices they’re allowed to use. Specify which devices qualify and what information responders may access through them. Otherwise, the emergency communications plan may depend on equipment the team has been instructed to stop using.

There isn’t one setup that fits every company. Size, risk profile and existing systems will shape the choice. The practical measure is whether responders can keep working without depending on the environment investigators are examining.

Rehearse the decision to move

A backup channel that works in a demonstration may still fail during a real incident. Teams also need to practice recognizing when the primary environment can’t be trusted, telling the right people to switch and continuing the response without exposing the move through compromised systems.

A tabletop exercise can test this judgment by presenting evidence that an attacker accessed several responders’ email and collaboration accounts while both services appear normal. Participants can work through what evidence triggers the move, who is authorized to call it and how the team will verify identities in the alternate channel.

Include security, legal, executives and essential outside partners. Introduce complications that put the process under pressure: an executive sends conflicting instructions through corporate email, someone joins from an unfamiliar account, a contact number is outdated or a third party can’t authenticate.

These scenarios show whether a plan works when people are unsure whom to trust. Measure how long it takes the team to recognize the need to move, bring in essential participants, form a verified response group and brief leadership. When people repeatedly return to the affected environment for instructions or contact details, the exercise has exposed a dependency the written plan missed.

Incident plans often assume the organization will have a safe place to coordinate. That assumption merits the same attention as recovery procedures and containment playbooks. The team needs defined activation triggers, a clear decision owner and an alternate channel it has already used under pressure.

Business decisions, customer questions and response deadlines continue while an investigation is under way. When the communications environment may be part of the breach, the company’s ability to act depends on three practical answers: when to leave, where to coordinate and how to verify the people who arrive. A practiced answer to each can keep the response moving while investigators work out what can still be trusted.