Ready-to-send staff comms

Templates an IT or security manager can send today without writing anything. Edit freely and send under your own name. No attribution needed for internal comms, and no need to ask.

Replace anything in [SQUARE BRACKETS].

New starter, security basics

Short on purpose. A long induction email does not get read.

Subject: Four security things worth two minutes

Welcome aboard. Four habits matter more than everything else combined:

1. Never log in from a link in an email. Type the address or use a bookmark.
2. Do not open attachments you were not expecting, even from people you know.
3. Never change a payment or bank detail based on an email. Ring the supplier
   on a number we already had on file.
4. If something feels wrong, tell us immediately. You will never be in trouble
   for reporting something, including if you clicked it. Speed is what limits
   the damage.

If you think something has happened, ring [IT PHONE] rather than emailing, in
case email is the problem.

More detail, plain English: https://malware.com.au/avoid-malware/

Suspicious email doing the rounds

Send while it is still landing in inboxes, not after.

Subject: Suspicious email in circulation, please do not click

We are seeing an email arriving that claims to be [WHAT IT CLAIMS TO BE]. It
has the subject line "[SUBJECT]" and it asks you to [WHAT IT ASKS].

It is not genuine. Please do not click the link or open the attachment.

If you have already clicked it:
- Ring [IT PHONE] now. Do not wait to see what happens.
- If you entered a password, say so. That detail changes what we need to do.
- Do not delete the email. We need it.
- Do not turn your computer off.

You will not be in trouble. We would much rather hear about it in the next ten
minutes than tomorrow.

After an incident, all staff

Tell people before they hear it elsewhere.

Subject: [SYSTEM] security incident, what we know so far

On [DATE] we identified [PLAIN DESCRIPTION OF WHAT HAPPENED]. We are treating
it as a security incident and we have [WHAT YOU HAVE DONE: isolated systems,
reset credentials, engaged specialists].

What this means for you right now:
- [ACTION, e.g. you will be asked to reset your password today]
- [ACTION, e.g. [SYSTEM] is unavailable until further notice]

What we do not know yet: [BE SPECIFIC, e.g. whether any customer information
was accessed. We expect to know more by [DATE]].

Please do not discuss this outside the organisation, including on social media.
If a customer, journalist or supplier asks, forward it to [CONTACT] rather than
answering.

We will update you by [DATE AND TIME] whether or not there is news.

A note on the last line: commit to an update time and keep it. Silence is what turns an incident into a rumour.

Payment fraud warning, finance and accounts

The highest-value message in this list, because invoice redirection is among the costliest attacks on Australian businesses by direct loss.

Subject: Bank detail changes must be verified by phone, no exceptions

A reminder, because this attack is working on organisations like ours right now.

If you receive a request to change a supplier's bank details, or an invoice with
different details from last time:

1. Ring the supplier on a number we already hold on file. Never a number from
   the email or the invoice.
2. Confirm the change with a person who can be identified.
3. Only then update the record.

This applies no matter who appears to have sent the request, including anyone
senior. You will never be criticised for delaying a payment to verify it, and
that includes delaying mine.

The emails are usually genuine emails from a genuine but compromised mailbox,
inside a real conversation. There is nothing obviously wrong with them, which
is why the phone call is the control rather than your judgement.

Awareness month announcement

For October. See the October kit for a four-week schedule.

Subject: Cyber Security Awareness Month, four short things through October

October is Cyber Security Awareness Month. Rather than a training module, we
are sending one short thing a week.

This week: [TOPIC].

[ONE PARAGRAPH, OR A LINK TO ONE POSTER]

Posters are going up in [LOCATIONS]. If you want the reasoning behind any of
it, plain English and no jargon: https://malware.com.au/avoid-malware/

As always, if something looks wrong, ring [IT PHONE]. You will not be in
trouble.

What makes these work

• Short. Anything over a screen does not get read, so the templates above are deliberately shorter than they could be.
• Ring, do not email. Every template says this, because if email is the compromised channel then an email report goes to the attacker too.
• Say nobody gets in trouble, every time. Most successful attacks depend on somebody delaying a report out of embarrassment. Repeating this costs nothing and buys hours.
• One action per message. A message asking staff to do five things gets none of them done.