Everyday channels are available in an incident, but you may not want them
Summary
During a cyber incident, organizations often rely on everyday communication tools like email and Slack, which can become compromised. If attackers gain access to these channels, they can monitor response efforts, steal sensitive information, or impersonate team members, creating a secondary crisis. Incident response plans need to address not only the unavailability of communication tools but also the more insidious scenario where they remain functional but untrustworthy.
IFF Assessment
The article describes a scenario where an attacker compromises the communication channels used for incident response, which is detrimental to defenders.
Defender Context
Defenders need to ensure that their incident response plans account for the possibility of compromised communication channels, even if those channels appear to be functioning normally. This includes establishing out-of-band communication methods and validating the integrity of information shared during an incident.