An unfamiliar account appears during the incident

Among the storage records for a delayed report, a responder spots an account name they do not recognize. Perhaps it belongs to the backup job. Perhaps it is something the team needs to understand urgently. For now, the useful thing they have found is a question, not an attacker.

This fictional Dispatch tabletop gives that question somewhere to go. Dispatch creates downloadable reports; the service team is following delayed exports. Use its incident contact list and a place to draft two messages: one for the service response, one for the designated security or privacy specialist. This is a discussion using supplied evidence, with no live system changes.

An unfamiliar name is a starting point

An account is the identity a person or program uses to act. A scheduled backup can therefore leave an access record without anyone signing in. “I do not recognize this identity” describes the responder’s knowledge. “This access was unauthorized” would require an answer the team does not yet have.

Give the specialist a way to find the observation: the system, event time, action, identity exactly as recorded and why it differs from what was expected. Keep the original record in its approved location. One unfamiliar name does not establish a breach, but the fact that this began as an availability incident is no reason to dismiss it either.

The service team can keep following whether exports finish while the specialist examines access and directs evidence handling. Their work meets wherever a decision affects both: containment might interrupt customers, and a service repair might remove something the specialist needs to inspect.

Mention the restart before it happens

If the team is considering a worker restart, key rotation or machine rebuild, include that proposed change in the handoff before carrying it out under the applicable response plan. The specialist needs to understand not only what was seen, but what may be different by the time they look.

The service lead coordinates progress and approved stabilization. That role does not automatically grant all permissions to inspect, remove or disclose access information. Security and privacy specialists direct their parts under the organization’s policy.

A restricted exercise note could read:

At 11:14 UTC, the storage access record shows backup-reader reading the exports bucket. I do not recognize the identity, and its authorization is unconfirmed. The original event is in the approved evidence store under exercise-event-17. The service team is considering a worker restart. Please advise whether it would affect the investigation.

The identifiers are fictitious. The note gives the specialist a record to locate, a question to resolve and a pending action to consider. It does not send secret values or personal records into a channel where everyone involved in the outage might read them.

The service channel does not need the whole access record

For the general response, verified impact and progress may be enough: “Exports remain delayed. The service response continues, with a specialist review in progress.” Public status should likewise use approved facts about customer impact, not speculation about an attacker or a compromise.

The restricted escalation carries the access detail and proposed action. Where policy permits, link to the approved evidence location rather than copying sensitive records into each update. Put the two drafts beside each other. Can the service team follow progress without accidentally receiving details intended only for the specialist?

Someone wants to delete the account

That suggestion changes the question from “What is this identity?” to “What would removing it do?” Establish its role, evidence requirements and likely service impact, then bring the decision to the responsible security and service owners under the real response plan. Neither “delete it immediately” nor “never touch it” is a useful universal answer.

Imminent ongoing harm may require urgent containment through the organization’s emergency procedures. This exercise creates no such authority and replaces no specialist judgment. Its job is to connect the observation, the proposed action and the people entitled to decide while that decision can still be informed.

Now change the fictional evidence: the specialist confirms that the account belongs to a scheduled backup job. Record the finding and its source, and continue investigating availability. The escalation did not fail because it found an ordinary explanation. It resolved a question that mattered before somebody acted on a guess.

Keep the specialist contact route, an alternate, the restricted workspace, the decision owner and the communication approval route in the response map. Clearly marked placeholders are enough for this tabletop; real readiness requires closing those gaps. Next time an unfamiliar account appears, the responder should know where to take the question and be able to describe it without deciding the answer first.

Sources

NIST incident response guidance, SP 800-61 Rev. 3 is a general reference. Actual response and disclosure follow the local organization’s current procedures.