Skip to content

[REVIEW] ir-playbook: add communication channel integrity gates #1680

@yanziwei

Description

@yanziwei

Problem

ir-playbook tells responders to use out-of-band communications during severe incidents, but it does not require evidence that the communication channel itself was assessed, switched, access-controlled, preserved, and later restored safely.

That leaves an operational gap during SEV-1/SEV-2 incidents: responders may coordinate over corporate email, Slack/Teams, ticketing, or endpoint-management channels that the attacker can monitor, while containment orders and stakeholder notifications lack a reliable record of who approved what and through which trusted channel.

Proposed improvement

Add a focused communication channel integrity gate to the IR preparation workflow that requires responders to capture:

  • Channel trust status for email, chat, ticketing, phone bridges, paging, and IR-retainer portals.
  • The trigger and timestamp for switching to out-of-band communications.
  • Participant verification and war-room access control.
  • Preservation of decisions, approvals, containment orders, and notification records.
  • Explicit review of whether the adversary can monitor mailboxes, chat exports, IdP logs, ticket queues, or endpoint-management tools.
  • Named approver evidence for high-impact containment and public/regulatory communication actions.
  • Return-to-normal criteria before resuming internal channels.

This should be a documentation-only skill enhancement with no new tool permissions.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions