CISA’s StopRansomware Guide warns that malicious actors may monitor an organization’s communications and recommends coordinated isolation using out-of-band methods such as phone calls when necessary to avoid tipping them off. The lesson is broader than ransomware: email, chat, identity, endpoint management, directories, or network access may be unavailable, observed, or manipulated during an incident.
\r\nThe CISA Cyber Storm IX After-Action Report found that ordinary communication methods could be suboptimal during a cyber incident and identified the need for consolidated out-of-band capability and established primary and alternate methods. The Cyber Safety Review Board’s review of Lapsus$ describes out-of-band communication as an alternative separate from the primary channel and says it is best established before an attack.
\r\nDSE recommendation: design two related controls. The first is an alternate communications plane that does not rely on the systems most likely to fail together. The second is a responder-verification process that establishes who is in the channel and what authority that person holds. A working alternate chat tool solves availability; it does not prove that a display name belongs to an authorized responder.
\r\nCurrent threat reporting shows why channel access is not enough. A joint FBI and CISA advisory on Scattered Spider describes actors impersonating employees or IT staff to persuade help desks to reset passwords or multifactor authentication. Incident activation is an attractive setting for the same social engineering because urgency and unfamiliar participants weaken routine checks.
\r\nUse a trusted roster and a known contact path that the arriving person did not supply. Call a pre-recorded number, use a separately established organizational identity, or obtain confirmation from an accountable manager through another verified route. Require two authorized people to approve the addition of a participant who will receive sensitive evidence, administrative access, or decision authority. Confirm role and authority separately from personal identity. A code word shared widely or presented in the same suspicious conversation is not strong proof.
\r\nAssign an incident identifier, channel owner, participant recorder, decision log, and regular roll call. Mark authoritative instructions and require recipients to acknowledge high-impact actions. Record joins, departures, role changes, approvals, and handoffs. Share the minimum necessary secrets and evidence; an alternate channel should not become an uncontrolled repository for credentials, customer data, or malware samples. Give external counsel, insurers, vendors, and law enforcement a planned route appropriate to their role.
\r\nTest loss or compromise of the normal identity provider, email, chat, phones, devices, and directory in different combinations. Ask responders to activate the alternate plane, authenticate one another, add an outside party, issue a verified instruction, and preserve a decision record. After an actual incident, revalidate the participant list, export required records under policy, rotate exposed credentials, remove temporary access, and decide when normal communications can again be trusted. The outcome is not merely that a message was sent; it is that an authorized decision reached the correct operator through a channel both available and trustworthy.
\r\n