3

I work in a small company in Thailand, SE Asia. I am originally from Europe. I live and work there since many years, we all speak English in the company, and normally communication works fine.

I am responsible for IT and IT security.

Some time ago a hacker tried to hack our email accounts. Since then I check regularly all email activities from all users (I don't see the body of the emails, just the header). I check when each user (tried to) logon to which email account from where (IP address) and when. I look for multiple failed login attempts, unusual locations (IP addresses), etc.

If I find something strange like i.e. logon attempts from a different continent I ask the relevant user(s) if they have any idea how this could have happened. I.e. maybe they opened an attachment with a virus but they didn't think anything bad happened, so they didn't report it. Or maybe they downloaded something bad or something like that. Or maybe the users didn't do anything unusual and the hacking attempt is random.

My intention is to find out what happend and to make sure nobody hacks our system. But when I see something strange and ask users if they know why this might have happened then some users, especially one woman, think I accuse them of doing something illegal like giving out her password.

I try to make sure everybody understands that I don't accuse anybody. I just try to find out what happend. We all make mistakes from time to time and if a user opened i.e. a bad attachment then I want to know so that I can minimize possible problems. But it seems some people think I accuse them, however I formulate my request for information.

How can I make sure users understand that what I do is in the interest of everybody and in the interest of the security of out email system and reputation of our company.

I have the support of the boss. But obviously it would be good if people don't misunderstand my intention.

  • Could you implement something else while doing what you're doing? Like testing users with fake emails or attachments and if they click it, educate them on what they did wrong. Maybe require a mandatory training session. Maybe even a strong password reset policy or 2 factor authentication. – Dan Oct 18 at 18:29
4

Failed login attempts from remote locations are nothing new... as long as they have FAILED. This simply shows someone is trying to gain access to your account, however, many hackers will simply attack a very broad range of email addresses in the hopes that one of then has insecure access.

Once they are into your emails, they run a couple of scripts, and your left with the aftermath to clean up. Their job is done in a fraction of a second, so manual checks won't prevent this.

Onto the Workplace

Broad Emails

Board emails are addressed to everyone at the company. You can mention an attack, or just go on a general spiel about security and how its important to keep your passwords safe and secure. Whoever the offender is, should read this and understand that you know what they are doing, and hopefully fix the issue. Of course, it might have been a legitimate attack in which case they won't even notice.

You can also use this to link users to different training material and courses so that they can understand the importance of keeping their password security and not clicking on suspicious links.

Specific Person

In this scenario, you have a meeting with the person and discuss your findings with them. This is basically pointing fingers, so I would recommend you send out those broad emails first to make sure everyone is aware of the issue. Basically you have a meeting, ask her about the unusual activity. Make sure to reassure them that they are not going to be punished, just that you have noticed unusual activities and wanted to confirm if they were legitimate or an attack.

In General

Your average user will not know about hacking or the importance of password security and having multiple different passwords. You shouldn't ask them if they know why this happened or how something happened. You should ask them to verify facts that you have, not help you solve them. Ask them "Did you login to your email at XXX from XXX?". Don't ask them "Why did you log into your email at XXX from XXX?" because then you are accusing them of an action.

  • Thanks: So how do you suggest I ask them something like: Did you do or experience anything unusual at or before date x? Maybe they received a bad mail or they downloaded a virus, etc. – Edgar Oct 18 at 4:57
  • @Edgar You should ask the questions expecting Yes/No answers. An average user doesn't know if they downloaded a virus or clicked on some malware. It would have been accidental. So you can ask "Did your computer feel slow on X?" or "Was your computer unresponsive on X". Of course, none of this is conclusive evidence... it would be far safer for you to manually check their activity/emails/visited websites if possible and run the appropriate updates, virus scans and password resets. – Shadowzee Oct 18 at 5:21
  • Thanks, I get your idea. I just think about if I ask them to check the logs of their computer. I guess they will see this as another proof that I don't trust them and I want to find out what they did wrong... But in principle I agree with you. – Edgar Oct 18 at 5:37
  • 3
    @Edgar With a proper setup, you should be able to pull those logs from the network without their knowledge. If you do it to everyone, then it can be pushed as a new security initiative. Its only targeting them if you do it to a single person. – Shadowzee Oct 18 at 5:40
3

Try to detach yourself from the questioning as much as possible. Don't mention that you are personally going through the logs looking for things. Give them a scapegoat which is not yourself. You can say something like:

The logs indicated that there was a login attempt for your account from country X...

or

The logs recorded several failed login attempts on X...

This way, even if they are sure they did nothing wrong they are less likely to feel like you are personally accusing them of anything. You are simply relaying what "the system" is telling you.

One other thing is not mentioning that they may have opened an attachment or downloaded something when inquiring about suspicious activity. Conduct your investigation, determine what the cause of the breach was and then send a global email reminding everyone of safe practices. You could also reach out to your boss to see if some sort of basic security training is a possibility for all employees.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.