1

One of our co-workers followed a phishing link and entered their Google for Business account credentials. We have reset their password, is there anything else we need to do? (We also used this as a reminder for everyone to enable two factor authentication.)

The mail was also sent in their name to our staff mailing list (in BCC), so I assume it was also sent to other contacts in the address book. The headers indicate it was sent via Gmail, not from an external SMTP server (we have SPF records that only allow Gmail). Can we see who else got this mail, and is it useful to send a warning to them?

4 Answers 4

3

Block the phishing link in the company firewall. If the co-workers only read their mails in the office, this would suffice. But this seems highly unlikely. Further steps if the co-workers use company laptops, block the link on the laptop firewall too. Lastly, if they access it from any other personal device, make sure they know a phishing mail is going around which they should not click on. Attach a screenshot to the mail you sent around, on how the mail looks like. Besides that there is not much you can do other than scanning the computers where the link has been opened. Malware could have been installed through a drive-by download. Where malicious applications get installed through browser vulnerabilities. Hope this helps! Good luck

1
  • And we live in the same country, awesome :D
    – 4oxer
    Jul 3, 2014 at 9:32
1

For future occurrences (and you can be sure there will be more - the question is whether your employees will fall for that or not) you can consider purchasing some defense mechanism that will prevent the leakage of the credentials in the first place. For example Trusteer's Apex or ProofPoint

1
  1. Change the users email password, (Also suggest if this password has been used elsewhere (either in your company or outside on other websites) by collegue to change it their aswell to a new unique password)
  2. Check for any login attempts from unknown locations
  3. If such logins emails exist check logs for emails sent also check whats in the mailbox and assess what could have been seen by the bad person.
  4. Check other collegues and see if they have recieved such an email.
  5. Send notice to all staff and ensure they are aware of this email going around.
  6. Question collegue who recieved this email and ask if they entered their email into any new websites.
  7. You could create a list of other websites who have recently been breached and their customer data was leaked and ask you collegue if they were a member of any with the same email.
  8. Educate all staff on phising and what to look for in emails.
  9. Im not sure on your current email system but you could install a spam, RBL, phising screeening system.
0

What I believe is you need to do as long term plans

  • Implement proper incident response mechanism
  • Give information security awareness sessions for employees. (E.g. IT Security Day)
  • Keep contingency plans for such events.
4
  • I think the OP was hoping for something more immediate and specific to this event.
    – schroeder
    Jul 3, 2014 at 18:25
  • Yep. Added the long term ;).
    – Kasun
    Jul 3, 2014 at 18:38
  • Thanks for these mid/long term suggestions, but I think my next question (or a rephrase of the current question) would be: what should be in a contingency plan for an event like this? The stolen password has been replaced, what other steps would make sense, or what areas need attention?
    – Jan Fabry
    Jul 3, 2014 at 19:11
  • What I think, you can create proper way of handling such event based on your experience you have now. 1st thing is you know where you faced difficult in incident such in administration side (i.e. proper way of reporting issue) and may be forensic side (i.e. method to call in house forensic team). So can make a plan based on that in case of future incident. 2nd You need to set up role-back of recovery, such change password and security questions etc.
    – Kasun
    Jul 4, 2014 at 7:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .