This one is based on a true story.....
Information Security lad: <* walking around the building and saw that most of the staffs "forgot" to lock their workstation's screen while they are away from their desk *> hmm.... I have sent many bulletins and reminders regarding this, but seems like they still don't get it. I have to do something.... I think my HR sis can help...
Information Security lad went to his HR friend and they work out an awareness "campaign"....
3 days later...
Information Security lad: <* walking around the building and saw a PC left without screen lock. He quickly sat down and open the email program *>. This going to be fun... I'm going to write an email...
Dear HR Manager,
Due to unforeseen circumstances, I'm sending this email to resign from my position immediately...... <* you get the picture *>
Sincerely yours,
Lady 1
Few seconds after that, he received a reply email from HR Manager:
Dear Lady 1,
We accept your resignation. You may leave the office now. I have instructed security to get in-touch with you.
Sincerely yours,
HR Manager
Information Security lad went around and did the same thing to few other "unlock" workstations.... after a while, his phone rang. It was the HR Manager..
HR Manager sis: Hei, come to my office now.. the fun just getting better...
He went and saw another lady was there... her eyes were red...
Information Security lad: What happened? Why she looks so upset?
HR Manager sis: I received an resignation email from this Lady 1 here, but she claims that she didn't write the email.. I have asked the IT guys to check, they said the email is authentic, definitely from her machine and her account.
Lady 1: <* trying to control her emotion *> I swear I didn't do it.... I need the job to support my son.. you have to believe me!
Mean while... there were other staffs start queuing in front of HR Manager office.. all of them look very depress and in-shocking mode....They were basically turned white....
Information Security lad: <* having fun inside... *> Lady 1, actually... this is a security awareness "campaign" and little proof of concept (PoC) we performed with cooperation of HR department. Basically it is to create awareness of what are the risks associated with forgetting to lock your workstation screen before you leave.... See, someone could have used you workstation you do something damaging while you are away...blah blah....
HR Manager sis and Information Security lad repeated the same process for few more "victims"....
The next day..... (and many days after.... )
Information Security lad: <* walking around the office.... *> hmm.. seems like news travels pretty fast here... everyone workstation's screen is locked now :)
Moral of the story?
Sometimes.. a little nasty PoC is needed to stress the point ;)
Ain't security fun? ;)
No comments:
Post a Comment