In many of the recent attacks, the initial entry point into the target organization has been attributed to employee error. Specifically, employees have clicked on attachments or hyperlinks in email or on web sites that provide the means of compromising their employer’s systems. Ransom ware and other exploits are becoming ever more sophisticated.

Web Sites, Social Media, and Public Email
  • Don’t get hooked on someone’s fishing line. Do not reply to or click on links in emails, pop-ups, or websites that ask for personal information, financial information, health information. Never click on links or open files in an email from someone you do not know or weren’t expecting.
  • Always proceed with the understanding that no public email or messaging service (e.g., services provided by online services such as Google, Yahoo!, Microsoft, Skype, and others) is secure and that all communications will be stored and, potentially, viewed by others.
  • Avoid sending highly sensitive information through unsecured email, texts, or other communications (e.g., Gmail, Yahoo mail, text apps on smartphones, etc.).
  • Do not forward internal email, documents, or other information to a personal email address or download to personal devices for access outside of your employer’s systems. Your employer cannot protect the information once it’s been removed or shared outside of their systems.
  • When submitting personal or other sensitive information via a website, make sure you see the site’s address begins with https, as opposed to http. Think “s” stands for secure. Https uses encryption to send information across the internet, thus, reducing the risk that the information will be improperly accessed.
  • Think before you submit. Once submitted to a web site or transmitted through an online communication service, the information is public. You never know where the information will show up. There is no such thing as deleting information from the internet. The internet is forever.
  • Exercise caution using services and devices that record your communications (e.g., Google Voice, Siri, Cortana, Skype, VOIP applications, mobile app-based texting, etc.).
  • Before posting pictures and videos online, remember they may contain GPS data showing where the picture was taken.
  • Be mindful of backup applications running on personal devices (e.g., Dropbox, iCloud, Carbonite, etc.) making copies of sensitive company information and storing them online.
  • Think before you open. If you don’t know the sender, are unsure of why the attachment was sent, or if it looks suspicious, don’t open the attachment. Better to verify with the sender then infect your computer, or worse, the network.
  • PDF files are a very popular way of distributing viruses. Before opening a PDF, be sure you know where it came from.
  • When installing apps on your smartphone be cautious of requests to access your calendar, contacts, texts, GPS, and other data. In many, if not most, instances, there is no reason for these apps to have access to your data and, in almost all instances, whatever you choose to share will likely be analyzed and sold to others.

Only Authorized Software

  • Do not download or install unauthorized or unapproved software or applications from the internet.
  • In particular, never install encryption software, remote access, backup or other similar software without the express approval of your information security personnel.
  • Always be certain of the source of downloaded software (i.e., you are actually getting the software from the true creator of the software). It is common for hackers to create fake web sites and even hijack” visitors from official web sites where applications can be downloaded. In some instances, the top search results for a piece of software on Google and other search engines point to disguised hacker web sites where your personal information may be stolen and viruses propagated.
  • For your personal computers, make sure you have antivirus and firewall software installed. There are many inexpensive complete security packages available for home systems. Also, always promptly install security and other updates to your personal computer and mobile device operating systems.
Be Constantly Vigilant
  • Be suspicious of calls from unrecognized numbers alleging to be security or other officials asking for confidential information, including account access credentials and passwords. Look up the person calling and call them back at their published number.
  • Never reveal personal or business account access credentials or passwords in email or telephonically. No valid security personnel will ever ask you to reveal that information using either of these methods.
  • Be wary of urgent requests to issue checks or take action to avoid some issue without confirming the source.
  • Monitor the physical security of laptops, smartphones, and other mobile devices.
  • Avoid using public internet Wi-Fi to access company systems without use of a secure virtual private network.
  • If something is suspicious, report it.