To the ones who still report the phishing suspicion at 5:55 pm

Friday, 5:55 pm. The jacket is already hanging over the back of the chair. One last email: a parcel delivery that failed, a link to choose a new date. The link has already been clicked when the page starts to look odd. A login window that looks almost like your own.

Now there are two options. Close the laptop, go into the weekend and hope it was nothing. Or call the IT number, press the report button and say a sentence nobody finds easy: "I may have clicked on something."

What the report prevents

Anyone entering credentials on a fake page hands them to someone who can work with them immediately. If the report comes at 5:55 pm, the password can be reset and the session ended by 6:05 pm. If it comes on Monday at eight, someone else has had a weekend: for a forwarding rule in the mailbox, for emails to customers in someone else's name, for the next step into the network.

No filter and no monitoring detects such a click as early as the person who just made it. The report is therefore often the earliest detection an organisation gets at all.

Where it is required

IT-Grundschutz assumes that this report is possible. In module DER.2.1 Handling of security incidents, requirement A9 asks that it be ensured (our translation)

"that staff can report security incidents quickly and easily via reliable and trustworthy channels."

For elevated protection needs, A20 goes further: it should be possible to report security incidents outside normal working hours too. So exactly at 5:55 pm on a Friday, and at 10 pm as well.

Why it is so hard

The report is a confession. Whoever calls is the person who clicked. In its threat description, the module describes a similar case from IT operations: a server is compromised because updates were missing, and to avoid consequences they are quickly installed before anyone can investigate the cause. The BSI's conclusion (our translation):

"A poor error culture has thus prevented an analysis of the problem."

Organisations where a report is followed by a reprimand stop getting reports. They only get incidents they have to find themselves, later.

To them

To the ones who still call shortly before closing time, although it is embarrassing and although it may have been nothing. And to the ones at the other end of the line who then say "thank you" and not "again?".

Sources

BSI IT-Grundschutz Kompendium, 2023 edition, module DER.2.1 Behandlung von Sicherheitsvorfällen, threat 2.2 and requirements A9 and A20 (German).

In the next part: to the ones who say "we don't know" in the crisis exercise. The previous part: To the ones who test the restore.