Conversation

Notices

1. Embed this notice
   Dave "Wear A Goddamn Mask" Cochran :donor: (dave_cochran@infosec.exchange)'s status on Wednesday, 15-Nov-2023 04:30:18 JST Dave "Wear A Goddamn Mask" Cochran :donor:

   Hypothetical: a user emails the "help, i am experiencing/have just had a cybersecurity incident" email address in order to validate that it's the correct one. As a person on the team that handles those emails, how annoyed are you?

   • Embed this notice
     Dave "Wear A Goddamn Mask" Cochran :donor: (dave_cochran@infosec.exchange)'s status on Wednesday, 15-Nov-2023 04:37:18 JST Dave "Wear A Goddamn Mask" Cochran :donor:

     • silverwizard

     @silverwizard same question, but your company was recently acquired by a larger one, and the email address in question is an "@olddomain.com" one LONG after everyone's been given and told to start using the "@newdomain.com" addresses.

   • Embed this notice
     Dave "Wear A Goddamn Mask" Cochran :donor: (dave_cochran@infosec.exchange)'s status on Wednesday, 15-Nov-2023 04:50:22 JST Dave "Wear A Goddamn Mask" Cochran :donor:

     in reply to

     • Altytwo Altryness, BS :verified:

     @whereisthespai assume that no alternate channels exist or, at least, are practical to use

   • Embed this notice
     Altytwo Altryness, BS :verified: (whereisthespai@infosec.exchange)'s status on Wednesday, 15-Nov-2023 04:50:22 JST Altytwo Altryness, BS :verified:

     in reply to

     @dave_cochran then I’d usually be glad that someone thought to verify that documentation was correct. I didn’t do that work at a larger place, so that would impact and may change the answer.
     The number of times that someone needs emergency comms isn’t often, so having contact established and therefore in contact history doesn’t hurt.
     It’s more a question of just how much workload does it actually add to have that, and in my case it added next to none and used a channel that was frequently quiet long enough to question if it was working.

   • Embed this notice
     Altytwo Altryness, BS :verified: (whereisthespai@infosec.exchange)'s status on Wednesday, 15-Nov-2023 04:50:23 JST Altytwo Altryness, BS :verified:

     in reply to

     @dave_cochran back when I did that as a triage person: if it’s a disturbingly quiet day, happy. If every single contact must be processed as an incident and that workload hasn’t been tuned to account for this scenario, not as happy. If they also contact on an alternate channel, to confirm comms happened as expected, happy again especially if they did so in person.