Four Security Weaknesses in a 25-Person Travel Agency

Ranking by immediacy of harm, not by how bad the practice sounds:

1. The live phishing email. It is an attempt in progress with a countdown attached. The .xlsm attachment can carry a macro, and the email openly asks for the portal password - which, because of weakness 1, unlocks eight people's work and the agency's booking capability. Harm can occur within one click, before anyone meets to discuss it. Immediate action beats all other priorities.

2. The still-active account of the employee who resigned in June. This is unauthorised access with legitimate credentials, which is the hardest kind to detect. She may still receive client passport scans and booking confirmations; she may have set forwarding rules or an auto-reply that leaks her absence; nobody would question her login. Every day it stays open widens an unlogged, unattributable access path - and if her personal email is compromised, so is the agency.

3. The shared agency01 login with the password under the keyboard. Ranked below the first two only because it needs an actor to exploit it, but it is severe: no accountability (every action looks like the same user, so no investigation is possible), instant lateral access for anyone who walks past the desk, staff who leave take the password with them, and the licence terms are being breached - which can cost the agency the portal account entirely.

4. The USB drive. The risky act has already happened, so this is now an unknown rather than a pending event; the question is containment, not prevention. Nonetheless a found drive plugged into a front-desk PC is a classic malware delivery route and the machine may already be infected. Treat it as a possible incident: isolate, scan, review.

The shared folder is arguably the worst long-term exposure of all - passport scans are sensitive personal data, card details attract payment-industry obligations, and all 25 staff including reception can open it. It is separated from the four because it is a design and legal-compliance failure rather than a single bad habit, and it changes the question from 'what should staff stop doing' to 'who should be able to see this at all'. Fixing it requires permission redesign and records of processing, not a reminder email.

Handling the objection

The owner is describing two fears: blame and exposure. Both are answered by separating the incident from the person. Meera should say plainly that the person who received the email did the right thing by not clicking and by telling someone, and that the agency's problem is a control gap, not an employee's character - the shared login exists because the agency chose one licence over eight, so the responsibility sits with management. A no-blame reporting rule is not generosity; it is the only way phishing gets reported quickly next time, because staff who fear punishment delete the evidence and stay quiet.

On the licence, the honest framing is that the licence exposure exists today and is already a breach; responding to a security incident neither creates nor publicises it, and discovery by the vendor during an incident is far worse than a quiet conversation now. Report upward and to the vendor in the same week.

First 24 hours

1. Do not click, do not open the attachment, do not forward it as an attachment. Use the report-phishing function, capture the sender address and headers, then delete from the mailbox.
2. Block the sender domain at the mail gateway, and warn all staff in a short message with what to do if they already clicked.
3. Ask who else received it; check the mail logs rather than relying on memory.
4. Rotate the agency01 password, sign out all sessions, remove the sticky note, and restrict the portal login to the people who truly need it.
5. Isolate the front-desk PC used for the USB and run a full scan; check for autorun behaviour and scheduled tasks.
6. Preserve evidence and start a simple incident log with times, actions and owners.

Why the departed employee's mailbox is not a side issue

An orphaned account is a working key with nobody watching the door. Its owner has no reason to protect it, its password may be reused elsewhere, and its login looks entirely normal in the logs. It may hold client passport scans and card data, it may still be receiving booking mail, and it may have forwarding or auto-reply rules that quietly send future mail outside the agency. Disable the account, set an out-of-office pointing to a monitored address if the role needs it, forward only what is necessary under policy, review mailbox rules and forwarding, and check sent items for anything unusual. Then add a joiner-leaver checklist so the next resignation is closed the same day.

Staff note (about 120 words)

Subject: Suspicious invoice email - what to do

Team, an email claiming to be from an airline partner with an invoice attachment was sent to our front desk this week. It was not genuine. Please do not open the attachment or reply, even if the sender seems familiar. We will never ask for your password by email, and no supplier needs it to send an invoice. If you receive something similar - wrong address, odd spelling, blurry logo, urgency, a request for a password or payment - do not forward it to colleagues. Report it to Meera or the IT desk and then delete it. Reporting is always the right call. Nobody will be blamed for reporting, and nobody will be blamed for being targeted.

Controls within a month

1. Named logins plus multifactor authentication on the portal. Removes most of the shared-login weakness: actions become attributable, and a stolen password alone no longer opens the door. It only reduces the phishing risk, because a user can still be tricked into approving a prompt - so pair it with number matching and user training. It also raises the licence cost, which must be put to the owner as a business decision, not hidden.
2. A leaver checklist owned by HR and IT, with a monthly access review. Removes the orphaned-account weakness almost completely for future leavers, and the monthly review catches accounts nobody remembered. It only reduces the risk from accounts already forgotten, which must be hunted down once.
3. Attachment filtering and macro blocking at the mail gateway, plus endpoint protection with USB ports restricted to approved devices. Blocks the delivery route for the .xlsm and the found-drive trick for most cases. It only reduces rather than removes, because filtered mail can still arrive from a compromised genuine supplier account and staff can still be persuaded to run something.

The shared folder of passport scans is not fixed by any of these three. It needs permission redesign with least privilege, so reception sees no client documents and only the ticketing and visa roles see what their work requires - plus a decision on whether the agency should hold that data at all.