The hiring department occasionally sends me Word documents asking to clear the file as "safe" to open and review for purposes like resumes etc.; they can come from anywhere and are often unsolicited job applications.
Based on the cornucopia of Word exploits out there and my relative inexperience I get a slight "nnngg" feeling every time I save one to my on-network machine to "check". I feel like I will be held responsible if I say something is safe, but realize pros commonly use free and paid malware scanners to make sure their exploits will pass scans. Before I took the role of "toothless cybersecurity champion" they essentially opened everything and hoped the MSP caught/stopped the bad stuff.
- Save file as to desktop from Outlook.
- Upload file usually to Virustotal and Jotti's Malware Scan
- Scan with the local endpoint scanner.
- If all scans negative: tell them to view the document but never click "Enable Editing, Enable Macros etc." (So far I can only assume they follow this advice but have no method of confirming).
Yes I realize this scanning could probably just be done by the receivers at this point, but this would only apply to documents of a non-sensitive nature, since I'm already disclosing them to VT and Jotti's
My improvement ideas:
- Don't accept unsolicited Word docs (hard to enforce with high business impact, was actually laughed at for this).
- Make a VM/off-network machine and send/open everything there first and monitor/binwalk (high time commitment with questionable success).
Are there any other obvious (to someone with more experience) ways I could improve my sheep dipping process?