2021 Common threat

Your organization uses a single sign-on service. You receive an email from that service notifying you that you need to click on a link and enter some personal information to verify your identity or else your account will be suspended. What should you do?

• Be cautious; cybercriminals want you to react without thinking first.

• Ignore the message and see if they really suspend your account.

• Provide the requested information to ensure your account stays active.

• None of the above.

According to the Verizon 2020 Data Breach Investigations Report, what leads to most data breaches?

• Using highly technical skills to hack into the organization’s network

• Hacking or breaking into an organization’s database to get customer information

• Stealing passwords from a sticky note on your computer

• Phishing emails that were disguised to look like they were sent by contacts or organizations you trust

What should you do to prevent becoming a victim of a phishing attack?

• Stop, look, and think before clicking a link or opening an attachment.

• Reply to the sender and ask if the message really came from them.

• Click on links or open attachments only if the message says it is urgent.

• All of the above

Halfway through your day, you receive an unexpected message from your single sign-on account asking you to enter your two-factor authentication code. This is strange because you’re already logged in. What is the best course of action?

• Close the message and complain in your head about all these security features.

• Stop, look, and think before providing the requested authentication code.

• Provide the code so you can continue working without further interruption.

• None of the above

In Kevin’s single sign-on demonstration, you witnessed Kevin falling for a spoofed email. What should you do to avoid this happening to you?

• Think about the nature of the email.

• Ask yourself if this is the normal course of business.

• Think about what the sender is asking you to do.

• Ask yourself if you have been asked to do this before.

Tim from IT calls you on the phone. He says your account was taken over and urgently needs you to go to a website to reset your password using the link he provides. Which of the following actions should you take to keep the organization safe?

• Don’t take any action; follow organization policies for reporting suspicious activities.

• Use the link he provides to reset your password; you don’t want to get in trouble.

• Ask Tim if his boss can get on the line to verify that the request is legitimate.

• Ask Tim to send you an email with the link so you know it is a legitimate request.

You get a message through social media from a colleague. The message says, “My account was hacked, so I had to create a new one. Please accept my connection request!” Which of the following actions will help keep you and your organization secured?

• Delete the request; you didn’t want to be contacted by them anyway.

• Accept the friend request; that sounds really unfortunate.

• Call their verified phone number and ask if the request is legitimate.

• Reply to the message and ask your colleague what happened.

You've received a text from your bank asking you to call the number provided to verify recent changes made to your account. Which of the following actions will help keep you and your organization secured?

• Call the number in the text and ask them to verify your account information before you answer any questions.

• Respond to the text because you think it might be a smishing attack.

• Call the number in the text and ask to speak to the manager about this suspicious message.

• Call the bank using the number you found on their verified website or the back of your bank card.

You receive an email from HR. It says: “One of our employees recently violated the dating policy. All employees need to use the included link to review organizational policy.” Which of the following actions will help keep you and your organization secured?

• Open the link right away and review the organizational policy.

• Ask a coworker if they know who this message is about.

• Ignore the email.

• Review the link carefully and notify IT/security if it's suspicious.

You receive an email containing an attachment that you were not expecting. Which of the following actions will help keep you and your organization secured?

• Follow your organization's security policy for reporting suspicious attachments.

• Respond to the message and ask the sender if it is a safe attachment.

• Open the attachment after you've read the email.

• Open the attachment right away; what's the worst that can happen?