Many attacks target people, not machines. Criminals play on haste, fear, curiosity and respect for the boss. It is often easier to trick an employee than to break into a system.
Common forms
- Phishing: an e-mail or message that pretends to come from a bank, a supplier, the postal service, the tax authorities, the IT department or a colleague. It asks you to click a link, open an attachment or log in.
- Smishing: the same by text message. Vishing: the same by phone call.
- Spear phishing: the message is written specially for you and uses real names and details from your job.
- CEO fraud: "the director" asks you to pay an invoice or send lists of employees quickly and confidentially. The sender is forged or the account has been taken over.
- Fake support: someone calls and says they are from IT or Microsoft, and asks you to install software or give a code.
- Physical access: a stranger follows you in through the door ("tailgating"), or pretends to be a tradesperson.
Warning signs
- The sender address looks almost right, but is slightly wrong.
- Claims of urgency: "do it now", "the account will be closed".
- Unusual requests, especially about money, passwords, code generators, salary data or lists of people.
- Links where the address under the mouse pointer does not match the text.
- Unexpected attachments, especially zip files and office documents that ask you to "enable content".
- Poor language, but not always. Modern scams can be well written.
What do you do?
- Stop. Haste is the fraudster's best helper.
- Do not click and do not open. Go to the website directly instead by typing the address yourself.
- Check through another channel. Call the sender on a number you already know, not a number from the message.
- Payments and changes of account number must follow the organisation's two-person procedure, even if "the boss" says it is urgent.
- Report suspicious messages to IT or the security officer. Report even if you have already clicked. A quick report can stop the damage.
- If you have typed your password into a fake page, change it at once and tell someone.
Why should you report even if you are ashamed?
Anyone can be fooled. What decides how serious it gets is how quickly the organisation finds out. A phishing attack that gives access to an e-mail account with personal data can be a personal data breach with a deadline for notifying Datatilsynet (lesson 7). Deadlines run from when the organisation became aware of the breach, so a delay on your part can make the whole organisation late.
Ransomware
Ransomware encrypts files and demands payment. Disconnect the machine from the network, but leave it switched on, and call IT immediately. Do not pay and do not negotiate on your own.
Social media
Do not post pictures of the workplace, screens showing customer data, access cards or internal documents. Criminals collect information there to build convincing attacks.