Protect your incident response channel from a patient adversary

If an advanced actor is inside your network, it may read the same email and chat your responders use. CISA's SolarWinds alert says the actor targeted the email accounts of key personnel, including IT and incident response staff, and advises out-of-band communications and a documented response plan.

What the alert says

CISA's alert reports that the actor targeted email accounts of key personnel, including IT and incident response staff. In its operational security advice, it recommends using out-of-band communications and having a documented plan for incident response, because of that targeting.

The point is simple. If your response plan lives in the system that is compromised, the adversary can read it.

What out-of-band means

A channel that does not depend on the systems you suspect. If your corporate email and chat run on the same identity provider that might be compromised, then they share fate. Out-of-band means a different provider, different accounts and different devices where practical.

Build it before the incident

1. Pick a separate channel. A messaging app or voice bridge from a different provider, with accounts not tied to your main identity system.
2. Keep a contact list offline. Names, personal or alternate numbers and roles, stored in a place that does not need the corporate network.
3. Store the plan outside the main environment. A printed copy or an encrypted file kept by a few people.
4. Agree on a start phrase. A simple way to confirm that a message to join the channel is real.
5. Limit membership. Only those who need to know. Add legal and communications contacts early.
6. Test once a year. Run a short drill where nobody may use corporate email.

Handling evidence safely

• Do not paste indicators or screenshots into systems you suspect.
• Keep case notes in the out-of-band space until you are sure of scope.
• Record who was told what and when.

What to avoid

Do not announce on corporate email that "we have found a breach". It may give notice to the adversary and expose staff to confusion. Do not forward the plan to broad lists.

Small company version

If you have five people, you still need a way to talk if email fails. A group on a messaging service on personal devices, plus a shared encrypted note with contacts and the first ten steps, is enough to begin.

Link to recovery

When you move to recovery, the same alert advises forensic imaging of affected systems and treating identity trust stores as compromised if administrative credentials or SAML abuse are confirmed. Your out-of-band space is where you coordinate that.

Quick check

Sources

• CISA AA20-352A

Last reviewed: 19 October 2026.