The fallout from the recent ransomware attack that hit 150 countries, including Ireland, over the weekend continues. For Payroll Professionals this poses a serious risk as the data they work with is some of the most sensitive that a business can possess. Many companies will pour money into high-tech security systems and forget the importance of the small stuff. A point which a lot of businesses forget to educate their staff. After all, any system can easily be accessed if due diligence is not given and the wrong action is taken online, with emails, attachments and hyperlinks. So here are a few points to be aware of and share with your staff to ensure you are doing all to keep your data safe – most importantly your payroll data!
Is the email from a trusted source?
Review the “From” address – attackers often impersonate or “spoof” staff by using incorrect spelling of names or domains (i.e. “@y0ur0rg.com”) you may be familiar with or in contact with
Review the subject of the mail
Attackers often try to include valid email information in the subject to trick the user into believing the email is legitimate.
Review the spelling and content of the mail
Attack emails often contain poor spelling and grammar.
“Is this mail relevant to my job role and responsibilities?”
Is the nature of the email related to your job function?
Does a mail refer to an action you did not take?
Typically attackers will draft these emails as responses to “requests” you may have made. Is there a mail trail of you seeking this information or file? Or is the email a once off?
Be vigilant of attachments
Attackers will often include a malicious file as an attachment to a phishing mail.
DO NOT open or interact with any attachments in strange or suspicious emails. Verify that:
– the sender is legitimate,
– the content of the mail includes a valid mail history,
– the attached file is one you have requested,
– the attachment is in the correct format (e.g. is this report an xsl instead of the usual PDF?)
Be vigilant of links
Attackers will also try to include links to malicious content or websites. DO NOT click on any links that you do not trust or are not familiar with.
Don’t forget hyperlinks
Attackers may use URL hyperlinks in the body of an email (e.g. “Click Here”).
– Typically, hovering over these hyperlinks will disclose the real destination of the link
– Right-clicking and copy and pasting this into a word processor can also be performed to review the link
Do not forward
Don’t send on suspicious emails to anyone, ever. If you want to get advice on an email, you can take a screen shot, but the email itself should *NEVER* be forwarded.
Delete again and again
If you have taken all due care and decided to delete the email, delete it again from your trash folder to avoid any unintended engagement with it in the future.