Phishing, a Shared PII Folder, and the Work-from-Home Email
You are the office’s information management officer. At 0730, an employee forwards you an email that appears to be from the IT help desk: “Your mailbox is full; click here to revalidate your password.” The employee says she clicked the link and entered her credentials before noticing the sender address ends in “-support.com.” She is on leave starting at noon. Separately, you discover a shared folder labeled “Awards_Board” containing 300 rows of names, dates of birth, and Social Security numbers, accessible to everyone in the building. A coworker has been emailing the folder to his personal Gmail so he can work from home. The command cyber awareness month briefing is next week.
1. What immediate incident response sequence should you follow for the phishing compromise?
Read the worked answer
Contain first. Ask the IT help desk or security office to disable the employee’s account and reset credentials, and check whether the account has been used to send mail, change rules, or access files. Do not delete the phishing email; preserve it with full headers, and preserve relevant mailbox and login logs. If the employee used a government laptop, coordinate with IT before allowing it back on the network.
Notify the appropriate security or cyber incident office promptly, using the agency’s required reporting channel and timeline. Give the facts you know: time clicked, credential type, sender address, and what the employee remembers entering. Do not speculate that “nothing happened” just because no obvious damage is visible.
The employee leaves at noon. Before she goes, obtain a brief written statement and an after-hours contact number, and tell her not to use the same password elsewhere until cleared. Briefing next week is not a substitute for reporting today. The reasoning is that credential phishing can lead to mailbox rules, data exfiltration, and lateral movement, so speed and evidence preservation matter more than a polished narrative.
2. How should you address the PII folder and the coworker’s personal-email use?
Read the worked answer
Restrict access to the folder immediately and identify who has already opened or copied it. Do not simply delete it; preserve evidence while the privacy and security offices assess the exposure. Notify the privacy officer and security office that 300 records containing names, dates of birth, and SSNs were broadly accessible. That is a potential data spill and may trigger breach assessment and notification requirements.
For the coworker, tell him in writing to stop forwarding government information to personal email, to delete the messages and any copies from his personal account, and to confirm deletion. Do not ask him to forward the data back through personal email. Notify your supervisor and the privacy office; disciplinary or administrative action is a management decision, not yours alone.
The reasoning is containment plus accountability. Personal email is not an authorized storage location, and remote work does not change the obligation to use approved systems. Document the access list and the corrective actions.
3. What prevention actions would you recommend after these two incidents?
Read the worked answer
Recommend measures aimed at the specific failures, not a generic “be more careful” campaign. First, enable or enforce multifactor authentication and review mailbox forwarding rules for unusual activity. Second, run a phishing simulation and use the results to coach users on sender-domain checks, not to embarrass them. Third, apply least privilege to the Awards_Board folder, remove broad building-wide access, and audit who needs PII. Fourth, require encrypted, approved collaboration tools for remote work and make the rule easy to follow so employees do not improvise with personal email.
Tie the actions to the cyber awareness month briefing: use the real incident in a sanitized, non-punitive way to show what a lookalike domain looks like and how to report it in one step. Add a quick reference for reporting suspected incidents and a contact for the privacy office.
Finally, document the corrective action plan with owners and dates. A briefing alone will not fix an access-control problem; the folder permissions and reporting path must change.