Cybersecurity · VIDEO
Cyber Incident: How to Manage the Crisis When the Attacker is Inside the Answer
During a severe cyber incident, response coordination may be compromised if the attacker has access to the company's communication tools. This article explores the challenges and solutions for maintaining communication security in critical scenarios.
KEY TAKEAWAYS
- The importance of an out-of-band communication plan for critical scenarios
- How to identify and mitigate the risk of unauthorized access to communication channels
- The integration of legal and operational aspects in incident management
- The importance of practical exercises to test response readiness
Transcript
A major cyberattack targeting corporate collaboration tools can escalate a security incident into a two-tier crisis. When platforms like email, Teams, or Slack are compromised, response teams face a unique challenge: coordinating the emergency through channels that may be monitored by the attacker.
Key points to consider:
- Attackers can read, modify, or impersonate internal communications. - An alternative predefined channel is essential for coordinating the response. - Identity verification must occur outside of corporate accounts. - Separation between operational coordination and legal analysis is crucial. - Planning must include alternative devices and updated contacts.
The greatest danger lies in the false sense of security that seemingly functional systems transmit. Attackers can monitor meetings, read conversations, or modify emails without obvious traces, making ransomware attacks particularly insidious.
Building a functional alternative channel requires an in-depth analysis of all shared dependencies. Identity verification is crucial to prevent impersonation. The plan must also include external legal consultants, forensic investigators, insurers, and communication consultants.
Effective exercises should simulate complex decisions, clear authorities for transition, identity verification procedures, and real-time authentications. The ability to timely recognize the need to switch to an alternative channel can make the difference between a contained incident and a prolonged crisis.
This preparation is integral to business resilience and should be tested and regularly updated. It can positively influence cyber insurance premiums and coverage, and meet compliance standards like ISO 27001 and DORA regulation.
With the rise in attacks targeting collaboration tools, companies must stay updated on the latest threats and adapt their plans accordingly. The psychological preparation of the response team is also vital during such crises.
