Responders suspect the attacker has access to the corporate email system that the incident response team normally uses to coordinate. How should the team communicate during the response?
Select an answer to reveal the explanation.
Short Explanation
If the burglar's listening on your phone line, you don't plan the stakeout over that same phone. You switch to the backup channel you set up beforehand. The trap answers just put new clothes on the compromised channel or improvise something insecure.
Full Explanation
When the systems an organization normally uses for coordination may be compromised, continuing to use them risks revealing response plans to the attacker, who can then adapt, evade containment or destroy evidence. Incident response plans therefore establish out-of-band communication channels in advance, such as separate messaging services, phone bridges or devices independent of the corporate environment, with membership and access arranged before an incident. Switching to those channels protects the confidentiality and integrity of response coordination. Adding encryption to corporate email does not help if the attacker controls the mail system, accounts or endpoints, because messages can be read before encryption or after decryption. Responders' personal email accounts are outside organizational control, retention and legal hold, may themselves be insecure and are improvised rather than agreed. Coordinating through comments in existing tickets still depends on corporate systems that may share the same identity infrastructure the attacker has compromised, and it is impractical for real-time decisions. Exam caveat: out-of-band channels must be tested and kept current; one never used before an incident often fails when needed. Operational check: confirm that the channel's member list is current, that it is independent of corporate identity systems and that exercises use it.