Official reports on two very different incidents reach the same advice: do not coordinate your response on systems the attacker may be reading. The CSRB found highly effective organizations used out of band communications, and CISA's advisory on the SolarWinds campaign said the adversary targeted email accounts of IT and incident response staff.
What the two sources say
The Cyber Safety Review Board's Lapsus$ review says highly effective organizations employed mechanisms such as out of band communications that let incident responders coordinate without being monitored by the threat actors.
CISA advisory AA20-352A on the compromise of government and private networks says the adversary targeted email accounts of key personnel, including IT and incident response staff, and advises planning out of band communications and a call tree.
Why normal channels are risky
If an attacker has an administrator's mailbox or your chat tenant, your containment plans are visible as you write them. They can change tactics, delete evidence or accelerate.
What an out of band setup looks like
- A separate communication tool, with accounts not tied to your main identity provider.
- A call tree with personal phone numbers, stored offline and printed.
- A shared document store kept apart from your corporate cloud.
- A rule for what is shared where. Technical detail goes in the secure channel only.
- Regular tests so people know how to join.
Set it up in a week
- Choose a tool whose login is independent of your primary directory, and enroll the response team.
- Print the call tree and store it with the incident plan, and check it twice a year.
- Add a first step to the runbook: move to the secure channel before discussing the incident.
- Test in a tabletop by declaring that email is untrusted.
Think about identity too
CISA's advisory also describes abuse of tokens and credentials for lateral movement. If identity is compromised, your secure channel must not depend on it.
Practice makes it routine
People forget a tool they use once a year. A short quarterly drill keeps accounts working and phone numbers current.
Safeguard's policies and compliance evidence automation can store the plan and the proof you tested it, but the channel itself should live outside your main environment.
Mistakes to avoid
Do not build the secure channel on the same single sign on as everything else. Do not store the call tree only in the corporate wiki. Do not invite the whole company, since a wide channel is easy to infiltrate. And do not wait for an incident to find out who has the app installed. Each of these has an easy fix if it is handled in a calm week.
Quick check
Is out of band always another app?
Not always. It can be a phone bridge or messaging group. The point is that it does not depend on systems the attacker may control.
Who should be in the channel?
The people who must decide and act, plus a scribe. Keep the circle small and add others when needed.
Sources
- CSRB, Review of the Attacks Associated with Lapsus$ and Related Threat Groups
- CISA advisory AA20-352A
Last reviewed: 19 October 2026.
