Your boss mentions that recently a number of employees have received calls from individuals who didn’t identify themselves and asked a lot of questions about the company and its computer infrastructure. At first, he thought this was just a computer vendor who was trying to sell your company some new product, but no vendor has approached the company. He also says several strange e-mails requesting personal information have been sent to employees, and quite a few people have been seen searching your company’s trash dumpsters for recyclable containers. Your boss asks what you think about all of these strange incidents. Respond and be sure to provide recommendations on what should be done about the various incidents.

words:250

reply:I think all the different sets of calls employees received from various unknown individuals are a clear indication of Scam calls, which could have been handled by employees by ignoring the calls and reporting a complaint about the incident in the first place. This did not happen in this case because of the lack of security threats awareness in employees. If there are necessary threat awareness sessions in the company on a monthly or quarterly basis there would have been a lot of difference in handling these sorts of situations. Employees would have immediately reported to the company’s security team about the phishing calls and avoided the total damage and loss of confidential data.

Recommendation:

Every Employer must include security awareness sessions and should be making sure that all the employees are attending different workplace Security and safety awareness sessions. So that they will be aware of different kinds of possible phishing attacks, scam calls and safety measures to consider during attacks and the employee must also be directed not to provide any information through any medium to any unknown person. Employers should also conduct phishing attack drills at regular intervals to make employees aware of phishing attack trends. Companies should impel every employee to be having some limited knowledge about the basic social engineering fundamentals including social engineering by phone, dumpster diving, on-line social engineering, reverse social engineering and persuasion to identify threats easily. Companies should encourage having only limited knowledge over social engineering fundamentals to avoid any insider threats. Security is all about maintaining the trust, Employer should consider random examination to employees who manage critical data. Equally, All employees should also be guarding information by considering company-related information as more critical and valuable. Overall the company management should maintain proper and appropriate security measures in storing confidential information.

words:150