Secure Messaging Practices
A quick favour over chat, and a client's identity is gone.
What Is Secure Messaging Practices?
Workplace chat feels private, so people send things through it they would never put in an email. A colleague messages on a Friday asking for a client record, then one more detail, then another. On Monday he says his account was compromised and he sent nothing. You work the response: call IT Security, file an incident report naming exactly what was disclosed and through which channel, and read the findings. A familiar name in a chat window is not authentication.
What You'll Learn in Secure Messaging Practices
- Recognize that a familiar name and an established chat thread are not proof of who is on the other end
- Identify incremental extraction, where a request escalates one small detail at a time, as a social engineering pattern
- Refuse to send client identifiers and personal data through consumer messaging apps regardless of who is asking
- Verify an unusual request from a colleague through a separate channel before disclosing anything
- File an incident report that records precisely what data was disclosed and through which channel so exposure can be scoped
Secure Messaging Practices — Training Steps
-
A Routine Friday
It's Friday afternoon. You're wrapping up for the week when an email arrives from a satisfied client.
-
A Message from Marcus
Alice's phone buzzes with a Telegram notification from Marcus Webb, a colleague on the client services team.
-
Looking Up the Client File
Marcus seems to be in a rush. Alice pulls up Eleanor Patterson's client record on her desktop to find the account number he needs.
-
Sharing the Account Number
Eleanor's account number and other details are right there on the screen. Alice switches back to Telegram to send Marcus the information.
-
Just One More Detail
Marcus is asking for Eleanor's Social Security Number now. It feels like a lot to share over Telegram, but the portal is down and he needs to process this refund before the end of business.
-
What Went Wrong?
Take a moment to reflect on the conversation that took place on Friday.
-
A Monday Morning Shock
Alice arrives at work Monday morning to find a troubling email from Marcus Webb.
-
Connecting the Dots
Alice feels a wave of dread. She shared Eleanor Patterson's account number AND Social Security Number with someone pretending to be Marcus. That data is now in the hands of an attacker.
-
Calling IT Security
Alice picks up her phone immediately. She needs to report what happened so the security team can act before the attacker uses Eleanor's data.
-
Accessing the Security Portal
IT Security asks Alice to file a formal incident report through the Security Portal so the response team can begin investigating immediately.
Security Framework Coverage
MITRE ATT&CK
- T1552.008 Unsecured Credentials: Chat Messages
CIS Controls
- CIS 14.4 Train Workforce on Data Handling Best Practices
NIST CSF
- PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind