4

I work in a small company in Thailand, SE Asia. I am originally from Europe. I live and work there since many years, we all speak English in the company, and normally communication works fine.

I am responsible for IT and IT security.

Some time ago a hacker tried to hack our email accounts. Since then I check regularly all email activities from all users (I don't see the body of the emails, just the header). I check when each user (tried to) logon to which email account from where (IP address) and when. I look for multiple failed login attempts, unusual locations (IP addresses), etc.

If I find something strange like i.e. logon attempts from a different continent I ask the relevant user(s) if they have any idea how this could have happened. I.e. maybe they opened an attachment with a virus but they didn't think anything bad happened, so they didn't report it. Or maybe they downloaded something bad or something like that. Or maybe the users didn't do anything unusual and the hacking attempt is random.

My intention is to find out what happend and to make sure nobody hacks our system. But when I see something strange and ask users if they know why this might have happened then some users, especially one woman, think I accuse them of doing something illegal like giving out her password.

I try to make sure everybody understands that I don't accuse anybody. I just try to find out what happend. We all make mistakes from time to time and if a user opened i.e. a bad attachment then I want to know so that I can minimize possible problems. But it seems some people think I accuse them, however I formulate my request for information.

How can I make sure users understand that what I do is in the interest of everybody and in the interest of the security of out email system and reputation of our company.

I have the support of the boss. But obviously it would be good if people don't misunderstand my intention.

1
  • Could you implement something else while doing what you're doing? Like testing users with fake emails or attachments and if they click it, educate them on what they did wrong. Maybe require a mandatory training session. Maybe even a strong password reset policy or 2 factor authentication.
    – Dan
    Oct 18, 2019 at 18:29

3 Answers 3

4

Failed login attempts from remote locations are nothing new... as long as they have FAILED. This simply shows someone is trying to gain access to your account, however, many hackers will simply attack a very broad range of email addresses in the hopes that one of then has insecure access.

Once they are into your emails, they run a couple of scripts, and your left with the aftermath to clean up. Their job is done in a fraction of a second, so manual checks won't prevent this.

Onto the Workplace

Broad Emails

Board emails are addressed to everyone at the company. You can mention an attack, or just go on a general spiel about security and how its important to keep your passwords safe and secure. Whoever the offender is, should read this and understand that you know what they are doing, and hopefully fix the issue. Of course, it might have been a legitimate attack in which case they won't even notice.

You can also use this to link users to different training material and courses so that they can understand the importance of keeping their password security and not clicking on suspicious links.

Specific Person

In this scenario, you have a meeting with the person and discuss your findings with them. This is basically pointing fingers, so I would recommend you send out those broad emails first to make sure everyone is aware of the issue. Basically you have a meeting, ask her about the unusual activity. Make sure to reassure them that they are not going to be punished, just that you have noticed unusual activities and wanted to confirm if they were legitimate or an attack.

In General

Your average user will not know about hacking or the importance of password security and having multiple different passwords. You shouldn't ask them if they know why this happened or how something happened. You should ask them to verify facts that you have, not help you solve them. Ask them "Did you login to your email at XXX from XXX?". Don't ask them "Why did you log into your email at XXX from XXX?" because then you are accusing them of an action.

4
  • Thanks: So how do you suggest I ask them something like: Did you do or experience anything unusual at or before date x? Maybe they received a bad mail or they downloaded a virus, etc.
    – Edgar
    Oct 18, 2019 at 4:57
  • @Edgar You should ask the questions expecting Yes/No answers. An average user doesn't know if they downloaded a virus or clicked on some malware. It would have been accidental. So you can ask "Did your computer feel slow on X?" or "Was your computer unresponsive on X". Of course, none of this is conclusive evidence... it would be far safer for you to manually check their activity/emails/visited websites if possible and run the appropriate updates, virus scans and password resets.
    – Shadowzee
    Oct 18, 2019 at 5:21
  • Thanks, I get your idea. I just think about if I ask them to check the logs of their computer. I guess they will see this as another proof that I don't trust them and I want to find out what they did wrong... But in principle I agree with you.
    – Edgar
    Oct 18, 2019 at 5:37
  • 3
    @Edgar With a proper setup, you should be able to pull those logs from the network without their knowledge. If you do it to everyone, then it can be pushed as a new security initiative. Its only targeting them if you do it to a single person.
    – Shadowzee
    Oct 18, 2019 at 5:40
3

Try to detach yourself from the questioning as much as possible. Don't mention that you are personally going through the logs looking for things. Give them a scapegoat which is not yourself. You can say something like:

The logs indicated that there was a login attempt for your account from country X...

or

The logs recorded several failed login attempts on X...

This way, even if they are sure they did nothing wrong they are less likely to feel like you are personally accusing them of anything. You are simply relaying what "the system" is telling you.

One other thing is not mentioning that they may have opened an attachment or downloaded something when inquiring about suspicious activity. Conduct your investigation, determine what the cause of the breach was and then send a global email reminding everyone of safe practices. You could also reach out to your boss to see if some sort of basic security training is a possibility for all employees.

1

I work as the team lead in the IT Security team of my employer. I frequently have encountered similar, if not identical, circumstances as you describe. We understand why we are doing what we are doing and its importance in protecting the company.

However, the average non technical user outside of IT most likely does not. My experience supports this conclusion. If these users see unusual events happen on their computer, rather than thinking of the many different reasons as to why, they may just conclude its an IT employee "looking to hack". Hence, you need to remove the personal element from what you do.

I know your company is small, but does it have a documented incident response procedures as to what is expected of IT security employees when researching security logs? Having such a document allows you to transform your communications from one of personal suspicion to simply following an approved process that applies to all security incidents encountered by all company employees. The universalism of the policy and the implicit management support should help your cause and alleviate any complaining that come from end user employees.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .