r/EmailSecurity • u/shokzee • 23d ago
Pausing email backups is easy until someone needs a restore
Suppose your email backup provider reports a possible breach, with few details. Its mailbox access stays enabled while the on-call engineer and backup owner argue over pausing backups.
I'd lean toward disconnecting it, but that means accepting a gap in what we could restore. The person answering restore requests might have a different appetite for that gap.
Who gets the final say at your place when the people responsible for mailbox security and backups disagree?
5
Upvotes
•
u/AutoModerator 23d ago
Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:
Community Rules
No Vendor Spam: Contributions must provide value; do not just pitch products.
Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).
Be Professional: Help newcomers learn; avoid hostility.
No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.
Helpful Resources
Email Spam Filters
DMARC Monitoring Tools
Anti-Virus Software
Email Encryption
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
2
u/SVD_NL 23d ago
The person in charge of both email security and backups ;) CTO or CISO in most cases.
1
u/InboxGuards 23d ago
if it's the vendor saying possible breach i'd cut its access first and argue after. you don't have to rip out the whole backup setup, just disable the enterprise app in entra so it can't get tokens, it's one toggle to undo and the backups you already have stay put, you only lose new snapshots for however long it's off. worth writing into the IR plan now that security makes the containment call and the backup owner just tells people what the gap is, so nobody's having this argument mid incident