How can I make sure colleagues do not feel like I accuse them of doing something wrong?

Question

I work in a small company in Thailand, SE Asia. I am originally from Europe. I live and work there since many years, we all speak English in the company, and normally communication works fine.

I am responsible for IT and IT security.

Some time ago a hacker tried to hack our email accounts. Since then I check regularly all email activities from all users (I don't see the body of the emails, just the header). I check when each user (tried to) logon to which email account from where (IP address) and when. I look for multiple failed login attempts, unusual locations (IP addresses), etc.

If I find something strange like i.e. logon attempts from a different continent I ask the relevant user(s) if they have any idea how this could have happened. I.e. maybe they opened an attachment with a virus but they didn't think anything bad happened, so they didn't report it. Or maybe they downloaded something bad or something like that. Or maybe the users didn't do anything unusual and the hacking attempt is random.

My intention is to find out what happend and to make sure nobody hacks our system. But when I see something strange and ask users if they know why this might have happened then some users, especially one woman, think I accuse them of doing something illegal like giving out her password.

I try to make sure everybody understands that I don't accuse anybody. I just try to find out what happend. We all make mistakes from time to time and if a user opened i.e. a bad attachment then I want to know so that I can minimize possible problems. But it seems some people think I accuse them, however I formulate my request for information.

How can I make sure users understand that what I do is in the interest of everybody and in the interest of the security of out email system and reputation of our company.

I have the support of the boss. But obviously it would be good if people don't misunderstand my intention.

Answer 1

Failed login attempts from remote locations are nothing new... as long as they have FAILED. This simply shows someone is trying to gain access to your account, however, many hackers will simply attack a very broad range of email addresses in the hopes that one of then has insecure access.

Once they are into your emails, they run a couple of scripts, and your left with the aftermath to clean up. Their job is done in a fraction of a second, so manual checks won't prevent this.

Onto the Workplace

Broad Emails

Board emails are addressed to everyone at the company. You can mention an attack, or just go on a general spiel about security and how its important to keep your passwords safe and secure. Whoever the offender is, should read this and understand that you know what they are doing, and hopefully fix the issue. Of course, it might have been a legitimate attack in which case they won't even notice.

You can also use this to link users to different training material and courses so that they can understand the importance of keeping their password security and not clicking on suspicious links.

Specific Person

In this scenario, you have a meeting with the person and discuss your findings with them. This is basically pointing fingers, so I would recommend you send out those broad emails first to make sure everyone is aware of the issue. Basically you have a meeting, ask her about the unusual activity. Make sure to reassure them that they are not going to be punished, just that you have noticed unusual activities and wanted to confirm if they were legitimate or an attack.

In General

Your average user will not know about hacking or the importance of password security and having multiple different passwords. You shouldn't ask them if they know why this happened or how something happened. You should ask them to verify facts that you have, not help you solve them. Ask them "Did you login to your email at XXX from XXX?". Don't ask them "Why did you log into your email at XXX from XXX?" because then you are accusing them of an action.

Answer 2

Try to detach yourself from the questioning as much as possible. Don't mention that you are personally going through the logs looking for things. Give them a scapegoat which is not yourself. You can say something like:

The logs indicated that there was a login attempt for your account from country X...

or

The logs recorded several failed login attempts on X...

This way, even if they are sure they did nothing wrong they are less likely to feel like you are personally accusing them of anything. You are simply relaying what "the system" is telling you.

One other thing is not mentioning that they may have opened an attachment or downloaded something when inquiring about suspicious activity. Conduct your investigation, determine what the cause of the breach was and then send a global email reminding everyone of safe practices. You could also reach out to your boss to see if some sort of basic security training is a possibility for all employees.

Answer 3

I work as the team lead in the IT Security team of my employer. I frequently have encountered similar, if not identical, circumstances as you describe. We understand why we are doing what we are doing and its importance in protecting the company.

However, the average non technical user outside of IT most likely does not. My experience supports this conclusion. If these users see unusual events happen on their computer, rather than thinking of the many different reasons as to why, they may just conclude its an IT employee "looking to hack". Hence, you need to remove the personal element from what you do.

I know your company is small, but does it have a documented incident response procedures as to what is expected of IT security employees when researching security logs? Having such a document allows you to transform your communications from one of personal suspicion to simply following an approved process that applies to all security incidents encountered by all company employees. The universalism of the policy and the implicit management support should help your cause and alleviate any complaining that come from end user employees.