Cybersecurity
Cybersecurity Awareness
Most workplace incidents start with a person and a message, not with a movie-style break-in. This guide covers phishing, MFA, public Wi-Fi, and what to do in the first half hour after a mistake.
What this page is for
Awareness is the set of habits that make the common attacks fail against you. It is not a guarantee, a certification, or a security operations centre. It does not replace backups or account hygiene. It sits beside them.
Industrial control, medical devices, and emergency dispatch are outside this material. So is any technique for attacking a system. If your workplace has a written security policy, follow that policy when it is stricter than this page.
Guide: read a message before you click
Phishing is a message that wants a click, a reply, or a file, while pretending to be someone you already deal with. The sender display name is easy to fake. The actual address and the real destination of a link are harder to fake well.
- Look at the full sender address, not only the friendly name. A bank will not mail you from a free Gmail address.
- Hover a link (long-press on a phone) and read the address that appears. Check the spelling of the company name.
- Be suspicious of urgency plus secrecy: “do not tell anyone, pay this now, your mailbox will close today”.
- If the message asks you to open a macro-enabled Office file, do not enable macros unless you expected that file from a person you already spoke to.
- When unsure, open a new browser tab and type the company’s real address yourself. Do not use the message’s button.
Example: you receive “Invoice overdue — pay to this new account”. The invoice number is one you recognise, but the bank details changed. Stop. Call the supplier on a number you already have, not the number in the mail. Payment-diversion fraud lives on that exact gap.
MFA prompts you did not expect
If a password leaks, the attacker still needs the second factor. They often send a burst of sign-in prompts hoping you tap Approve to make the noise stop. That tap hands them the mailbox.
- Deny the prompt.
- From a device you trust, change the password of that account.
- Review recent sign-in activity if the product shows it (Microsoft 365 has this under the account’s security info).
- Tell whoever handles accounts in your office, with the time of the prompt.
- Do not use the same password on other systems. Change those too if they matched.
USB sticks, public Wi-Fi, and shoulder space
A found USB stick is not a gift. Plug it in only on a machine you are prepared to rebuild, which in a workplace is almost never. Public Wi-Fi in a café is fine for reading news. It is a poor place to type banking passwords without extra protection your workplace has actually issued.
Screens in an airport show mail. Privacy filters help. So does waiting. The workplace guide on screen lock still applies: workplace technology guides.
First half hour after you clicked
People freeze because they are embarrassed. Speed matters more than pride. You are trying to limit damage, not to write a confession with perfect wording.
- Disconnect the computer from Wi-Fi or unplug the cable if the click opened a download or a login page you submitted a password to.
- From a different device, change the password of the account you may have typed, and any account that used the same password.
- Tell a person in the office who can warn others. Forward the original message as an attachment if you still have it; do not open the link again.
- Write what you clicked, at what time, and whether you entered a password. That note is for the people who will check logs, including you tomorrow.
- Do not pay a ransom from a scare screen. Do not run random “cleaner” tools advertised next to the scare. Use the backup thinking in data backup education if files are suddenly gone or renamed.
Common mistakes
Posting an MFA code in a chat because someone claiming to be “IT” asked for it. IT staff who belong to your company already have other ways to prove who they are, and they should not need your SMS code. Recycling passwords between personal shopping sites and work mail. Disabling updates because a scare article said updates are risky — the opposite is usually true.
Fear campaigns that promise total protection also fail. This page does not. It reduces the chance of the boring, common incidents.
Awareness checklist
- You can name two signs of a phishing message besides “it looks odd”.
- You will not approve an MFA prompt you did not trigger.
- You know who in the office you would tell after a bad click, or you have written that you are that person for now.
- Work passwords are not reused on personal shopping sites.
- Found USB sticks stay unplugged.
- You treat this page as awareness training material, not as a managed security service.
Questions people ask
Does MFA mean we are safe?
No. MFA makes a stolen password much less useful. It does not stop you handing a file to the wrong sharing link, and it does not replace backups.
Can you monitor our mail for us?
No. This is a reading guide. It does not watch mailboxes or sell monitoring.
Put the habits next to the map
Fundamentals names the systems. Awareness protects the people who use them.