Cyber Incident Response Needs a Trusted Backup for Email and Collaboration
When attackers gain access to the systems a company uses to coordinate its response, the incident team can lose confidence in its own conversations. Email and collaboration apps may keep working, meetings may proceed as usual, and yet responders may not know who can read or change what they say. That uncertainty can expose containment plans, complicate legal analysis and slow decisions at the moment speed matters.
The practical gap is clear: many organizations prepare for email or chat to go offline, but fewer plan for those services to remain available while possibly under an attacker’s control. A serious cyber incident already brings security, IT, legal, communications and executives into close coordination. If they continue that work in a compromised environment, the response channel itself can become a source of risk.
Availability doesn’t establish trust
Companies often turn to familiar tools such as Slack, Teams, email, shared documents and video calls because employees already know how to use them. That familiarity helps under pressure, but it can also hide a dangerous assumption: that a working service is a trustworthy service.
Consider an attacker who has accessed the email and collaboration accounts of people on the response team. Investigators need to establish the scope of access and remove the intruder. If they discuss those steps in the usual incident channel, an attacker may see what the team plans to do. At the same time, legal needs reliable facts, communications staff are preparing for customer questions, and executives expect updates. Each conversation could disclose information useful to the intruder.
The team’s first question is no longer simply where to meet. It’s who can see the meeting, verify its participants and trust the instructions being shared there. I’m aware of cases in which attackers joined or recorded Zoom and Teams bridges used for incident discussions. A familiar interface can look normal even when the people in the room can’t be sure who else is listening.
This risk is easy to recognize during ransomware attacks, when systems fail and employees immediately need other ways to communicate. A compromised collaboration environment presents a subtler problem: it may remain available, making it harder to recognize that the team should stop using it.
Separate incident coordination from legal analysis
A company should assume that messages posted in a channel an attacker could access may have left its control. That includes containment plans, candid assessments of how the intrusion happened and draft statements about the incident. Such material could be used in an extortion attempt or appear later in litigation and discovery.
As I discussed in a previous CSO article, adding a lawyer to a large response channel doesn’t make every message privileged. Operational coordination and legal advice have different purposes, and a crisis doesn’t remove the need to manage access to sensitive discussions.
Legal teams should help design the out-of-band process before an incident. It should give responders a way to coordinate operational work, hold limited legal discussions and record the basis for important decisions. That record should make clear what the team knew, who made each decision and why. Trying to define these boundaries during an incident, while the primary channel may be monitored, adds pressure to an already difficult situation.
Build around dependencies, not an app
Choosing a backup messaging product is a starting point, not a plan. The stronger approach is to map how the primary and emergency channels depend on identity services, employee directories, managed devices, mobile device management and administrator credentials. If both channels rely on the same compromised account system or corporate device, the alternate route may fail along with the primary one.
Identity checks need particular attention. Someone with access to company email or calendars may learn that an emergency meeting is scheduled and have enough context to impersonate a responder or executive. Participants therefore need a way to confirm one another that doesn’t rely on the accounts currently under investigation.
The plan should cover external participants as well as employees. Outside counsel, forensic investigators, insurers and communications advisers may all need to join the response. Keep their contact details current, decide who can approve their involvement and establish how the team will authenticate them before a crisis. An outdated phone number or an unverified attendee can undermine the alternate channel at the point it’s needed.
Devices are another dependency. If responders are told to disconnect corporate laptops, they need to know which other devices can reach the emergency channel and what information those devices may contain or access. The plan should explain how participants will connect without relying on equipment that investigators may need to isolate.
There’s no single setup that fits every organization. The useful test is whether the response can continue if the company must distrust the environment it normally uses. A backup channel that shares too many dependencies with the primary one may offer little protection.
Rehearse the decision to switch
Testing that a backup service works doesn’t show whether a team can recognize when to use it. Responders need to practice deciding that the primary environment is no longer trustworthy, alerting the right people without exposing the change, and confirming who has arrived in the alternate space.
A tabletop exercise can start with evidence that an attacker has accessed several responders’ email and collaboration accounts, while both services still appear operational. The team then has to decide what evidence triggers a move, who can authorize it, and how participants will verify their identities once they switch.
Include security, legal, executives and essential outside partners. Add realistic complications: an executive sends instructions from corporate email that conflict with the alternate channel; someone joins from an unfamiliar account; a contact number is stale; or a third party can’t complete the agreed identity check. These moments show whether the process can withstand uncertainty, not just whether its tools can connect.
Measure the time needed to recognize the problem, reach essential stakeholders, establish a verified response group and brief leadership. Pay attention whenever someone returns to the affected environment because the alternate process is unclear or incomplete. Each such fallback points to a dependency or decision that needs work.
Incident plans often assume responders will always have a safe place to coordinate. That assumption deserves the same attention as backup systems, recovery steps and containment procedures. Teams need clear triggers for leaving familiar tools, a named decision maker and an alternate channel they’ve already used in practice.
When communications become part of a breach, internal decisions and external obligations keep advancing. A practiced out-of-band process gives the company a way to keep working while investigators determine what can still be trusted.
