What tool are you using for out of band communication to the Executive team during a cyber event?  I was thinking of using Signal but my team thinks we should use Rocket Chat.

Security & GRCProcess Management
1.5k viewscircle icon3 Comments
Sort by:
Director of IT in Government4 months ago

We are considering going old school with a cell-based audio conference call as a possible alternative should "internet" based services become un-available. 

VP of Information Security in Education4 months ago

We used Teams as well.  Clemens above added a lot of good pros and cons.  If you use something else, just be careful about retention requirements.  With Signal users can set self deleting messages, and you do not want to be asked for those messages later, only for them to have vanished.

Director of IT4 months ago

We've started with a separated MS Teams tenant not connected to our own Entra ID for our ITRBC communication and additional emergency document collection. Selection depends a bit if you really only want to use chat or additional functions as well.

Pro:
O365 integration, known gui and (with some constraints) usable just via any browser and mobiles. Authentication & user management separated from regular Entra ID.

Con:
Still MS Tech. - should MS cloud services get compromized in general during a cyber event, the usage of a separate MS tenant might not be feasible. MS Teams features for browser only gui are limited / not 1:1 comparable with fat client.

Thus, we are currently considering other options (i. e. such as wire) as well. Challenge: Howto deal with MS document formats if you really only want to use / edit these formats in your secure tenant without downloading to your (potentially compromized) regular environment?

Nevertheless, for chat, any MS independent messenger / chat tool with an own authentification and role model without Entra ID integration might work.

Content you might like

Post-pandemic, will your team be working fully remote, in-person, or hybrid?

Remote26%

In-person27%

Hybrid46%

View Results

Do you think your board/executive leadership understands cybercrime as an industry in itself?

Yes39%

Some but not all54%

No6%

I don’t know

View Results

What steps do you typically take when you notice a security team member becoming less and less engaged? How do you approach them to diagnose/address the issue?

Read More Comments

Have you evaluated any “AI native” data security platforms so far (like Concentric AI, Normalyze, etc)? Interested to know your thoughts on these, whether or not you move forward with implementing.

As part of our NYSE IPO prep, we’re debating how to communicate our system hardening efforts in regulatory disclosures (e.g., SEC Form 20-F, SFC).

Would you recommend sharing % compliance (e.g., “85% CIS Tier 2”) or sticking to qualitative descriptions of how we identify and mitigate risks? Also, do SFC/ISO 27001 expectations require full ISMS integration, or is a % model acceptable?