1

I'm responsible for the IT security of a small (~5 users) office, and I'm preparing training materials for our users.

Obviously, the first step my users should do if anything seems suspicious is to keep calm and contact me. However, if I'm unavailable for whatever reason, I need some rough guidelines that my users can use to determine whether to initiate emergency procedures (disconnect from Internet/shut down PCs) or not.

In a nutshell, I'm looking for heuristics that my end users can use. I don't want the office shut down every time a Windows Update bug makes TiWorker.exe run wild, but I also don't want to them to miss obvious signs of a compromise. I haven't had contact with live malware for decades, so I don't know what it "feels like" currently to have ransomware do its dirty work in the background on your PC.

The users are (mostly) software developers, so they definitely have more-than-average IT skills, but they are not security experts. The PCs are Windows 10/11 desktops with local admin permissions and active UAC. Ideally, I'm looking for stuff that they can check themselves without having to elevate their privileges (to avoid making matters worse in case of an attack).

These are the things I have come up with so far:

  • Unprompted mouse movements or keyboard input (i.e. active remote desktop control software)
  • Unexpected, persistent UAC prompts (i.e. an attacker trying to elevate their privileges)
  • Windows Defender firewall suddenly not running any more (since this is what I would expect malware to turn off)
  • Suspiciously-looking processes taking up a lot of CPU (not sure if I should include this or not, due to high chance of false positives)

Anything else? If you think that this exercise is pointless and I should give my users completely different guidance, feel free to say so as well.

Improve this question
6
  • Would it be that bad to briefly interrupt someone's work for a realistic compromise exercise because, say, Microsoft decided your users should be greeted by a totally-not-suspicious new Internet Explorer launcher placed on their desktop? There could easily be zero obvious indicators of a professionals work anyway, so why not train them specifically on the sort of unprofessional third-party interference they can notice. The sort of which you already have examples every now and then, without having to call it contact with live malware?
    – anx
    Commented Jul 28, 2023 at 14:43
  • 1
    I strongly object to telling non-expert users to watch out for things that automatic audit collection would notice whenever they could, and more reliably so.
    – anx
    Commented Jul 28, 2023 at 14:49
  • I really wouldn't tell them any of those bullet points. Just tell them to run a virus scan if the computer is acting funny and show them how to do that. The bullet-points you list will just lead to unnecessary freak-outs.. Better to teach behavior that prevents infections. ("Cybersecurity Training") I would also turn off remote-desktop at the OS level and put a policy in place that prevents anyone from installing that kind of thing. (A lot of companies will try to provide support that way, and you should make it clear that this is not allowed.)
    – browsermator
    Commented Jul 28, 2023 at 18:18
  • Unfortunately, this is almost impossible to answer since you want something 1. specific to your environment, 2. specific to your users, and 3. where the outcome is "office shutdown". And you never explain what monitoring tools there are, who has access to tools, what alerting is in place, what types of data is collected, etc. I'd approach the situation entirely differently dependent on those details.
    – schroeder ♦
    Commented Jul 30, 2023 at 9:22
  • You want to be able to equip the users with the right training to participate in the "detection/identification" phase of an incident, and that's good and useful, but there is no blanket answer we can give. As mentioned above, it is better to have comprehensive monitoring and give users read access to that and train them in it. I'd also suggest gentler responses than "full office shutdown". In addition, I'd suggest a more resilient approach where the office is resilient to being compromised, so the response would simply be to switch environments.
    – schroeder ♦
    Commented Jul 30, 2023 at 9:25

1 Answer 1

Reset to default
-1

Trusting users is the worst thing you can do. The best thing to do, like previous comments mention, is to educate the users to prevent the compromise from the beginning. There are solutions that can help with that (like KnowB4), but with a little bit of research you can put something together. In addition, you can use tools like MetaAccess to get visibility to the users' endpoint and security posture (I believe the free tier should be enough for what you need)

Improve this answer
2
  • 1
    The comments never say that "Trusting users is the worst thing you can do." What the comments are saying is that the proposed points and proposed reactions have consequences. I think you've blown the comments out of proportion. You can teach users what to look for in order to escalate incident response. In fact, training like KnowBe4 goes into that in-depth.
    – schroeder ♦
    Commented Jul 30, 2023 at 9:20
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Jul 30, 2023 at 9:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .