If you're not sure you've seen an incident, report it anyway
by Neal Fisch in attacks, awareness, data security, passwords, personal security, phishing scams, security, spear phishing attack, tips 0
Most security folks (and IT folks, for that matter) would rather hear about a problem from you than to figure it out afterwards while troubleshooting a system failure. If you receive a phone call from "User Support" doesn't sound quite right, if a common email announcement is just a little off, or if a caller on the phone is too stressed to remember his or her password and asks you to provide it — don't be pressured and don't be rushed. Rush and pressure are among the "social engineering" hacker's best tools.
What should you do? Ask for help! Call your supervisor, call your IT group, and call your InfoSec group on the spot for assistance. You are just as responsible to the whole organization as the folks who support information security for the organization! Don't let one person's stress jeopardize the organization's information security.
If you encounter any of these scenarios, please contact the T&C Helpdesk (helpdesk@csuci.edu or (805) 437-8552) or the Information Security Office (infosec@csuci.edu) for assistance and remember, no T&C staff member will ever ask you for any personal information, including your passwords.
