--- title: Everyday channels are available in an incident, but you... description: Incident response plans often assume email, Slack or Teams are safe to coordinate in, but an attacker who has compromised those accounts can read containment... canonical: https://daily.dev/posts/everyday-channels-are-available-in-an-incident-but-you-may-not-want-them-xckxhubpj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Everyday channels are available in an incident, but you may not want them | daily.dev og:description: Incident response plans often assume email, Slack or Teams are safe to coordinate in, but an attacker who has compromised those accounts can read containment... og:url: https://daily.dev/posts/everyday-channels-are-available-in-an-incident-but-you-may-not-want-them-xckxhubpj og:image: https://api.daily.dev/og/posts/xCKXhUbpJ.png og:image:alt: Everyday channels are available in an incident, but you may not want them og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Everyday channels are available in an incident, but you may not want them **[CSO Online](https://daily.dev/sources/csoonline)** · 7 min read · 0 upvotes · 0 comments ## Summary Incident response plans often assume email, Slack or Teams are safe to coordinate in, but an attacker who has compromised those accounts can read containment plans and impersonate responders. Attackers have joined or recorded Zoom and Teams bridges used for incident meetings. Teams need a preplanned out-of-band channel, verified identity checks that don't rely on compromised accounts, and tested procedures covering outside counsel, forensic investigators and devices. Tabletop exercises should rehearse recognizing when the primary environment is untrustworthy and measure how long it takes to move, verify participants and brief leadership. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What should we do if an attacker has access to the email and Teams accounts our incident response team is using? Move coordination to a preplanned out-of-band channel that does not share dependencies with the compromised environment, such as identity services, managed devices or administrative credentials. Verify participants through a process that does not rely on the accounts under investigation, since an attacker with calendar or email access may impersonate an executive or responder in the compromised environment. _Teams building incident response playbooks can track practical breach coordination guidance on daily.dev._ ### Can putting a lawyer in an incident Slack or Teams channel make the whole conversation privileged? No, putting a lawyer in a large incident channel does not make every conversation privileged. Operational facts and legal advice serve different purposes, so teams should separate operational coordination from legal analysis and control who participates in sensitive discussions, since messages posted there may surface in an extortion demand or in discovery. _Security and legal teams shaping breach communication policy can follow this guidance on daily.dev._ ### How should a company test whether its backup incident communication plan actually works during a breach? Run a tabletop exercise starting from evidence that an attacker has accessed email and collaboration accounts, even though those services still function normally, and measure how long it takes to recognize the need to move, activate stakeholders, establish a verified response group and brief leadership. Add complications like conflicting executive instructions or an unauthenticated third party to expose missed dependencies. _Security leads rehearsing breach response can keep up with incident planning practices via daily.dev._ ## Similar posts on daily.dev - [Identity Abuse Through Trusted Communication Channels](https://daily.dev/posts/identity-abuse-through-trusted-communication-channels-a3zcgqrv1) · Unit 42 · 0 upvotes · 0 comments - [State-sponsored actors, better known as the friends you don’t want](https://daily.dev/posts/state-sponsored-actors-better-known-as-the-friends-you-don-t-want-9rbbfm5gw) · Cisco · 0 upvotes · 0 comments - [What you say during a cyber breach can — and will — be used against you](https://daily.dev/posts/what-you-say-during-a-cyber-breach-can-and-will-be-used-against-you-rjqyt5ugw) · CSO Online · 0 upvotes · 0 comments - [When “Hi, This Is IT” Comes Through Microsoft Teams](https://daily.dev/posts/when-hi-this-is-it-comes-through-microsoft-teams-teyqlhqzj) · Unit 42 · 0 upvotes · 0 comments - [Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access](https://daily.dev/posts/beyond-the-inbox-how-threat-actors-abuse-microsoft-teams-external-chat-for-initial-access-plsjdfn53) · Arctic Wolf · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ransomware](https://daily.dev/tags/ransomware) [View this post on daily.dev](https://daily.dev/posts/everyday-channels-are-available-in-an-incident-but-you-may-not-want-them-xckxhubpj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Everyday channels are available in an incident, but you may not want them","url":"https://daily.dev/posts/everyday-channels-are-available-in-an-incident-but-you-may-not-want-them-xckxhubpj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/everyday-channels-are-available-in-an-incident-but-you-may-not-want-them-xckxhubpj"},"datePublished":"2026-10-30T10:06:43.073Z","dateModified":"2026-10-30T10:48:06.435Z","description":"Incident response plans often assume email, Slack or Teams are safe to coordinate in, but an attacker who has compromised those accounts can read containment...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/535169aeab91a6650b73dff8fdfce512?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/535169aeab91a6650b73dff8fdfce512?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/everyday-channels-are-available-in-an-incident-but-you-may-not-want-them-xckxhubpj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ransomware","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"Everyday channels are available in an incident, but you may not want them"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/everyday-channels-are-available-in-an-incident-but-you-may-not-want-them-xckxhubpj#faq","mainEntity":[{"@type":"Question","name":"What should we do if an attacker has access to the email and Teams accounts our incident response team is using?","acceptedAnswer":{"@type":"Answer","text":"Move coordination to a preplanned out-of-band channel that does not share dependencies with the compromised environment, such as identity services, managed devices or administrative credentials. Verify participants through a process that does not rely on the accounts under investigation, since an attacker with calendar or email access may impersonate an executive or responder in the compromised environment. Teams building incident response playbooks can track practical breach coordination guidance on daily.dev."}},{"@type":"Question","name":"Can putting a lawyer in an incident Slack or Teams channel make the whole conversation privileged?","acceptedAnswer":{"@type":"Answer","text":"No, putting a lawyer in a large incident channel does not make every conversation privileged. Operational facts and legal advice serve different purposes, so teams should separate operational coordination from legal analysis and control who participates in sensitive discussions, since messages posted there may surface in an extortion demand or in discovery. Security and legal teams shaping breach communication policy can follow this guidance on daily.dev."}},{"@type":"Question","name":"How should a company test whether its backup incident communication plan actually works during a breach?","acceptedAnswer":{"@type":"Answer","text":"Run a tabletop exercise starting from evidence that an attacker has accessed email and collaboration accounts, even though those services still function normally, and measure how long it takes to recognize the need to move, activate stakeholders, establish a verified response group and brief leadership. Add complications like conflicting executive instructions or an unauthenticated third party to expose missed dependencies. Security leads rehearsing breach response can keep up with incident planning practices via daily.dev."}}]} ```