Welcome to The Senroc Download! The month of October is Cybersecurity Awareness Month. This month we’re bringing you a special series dedicated to the many forms a cyber attack can take, how to detect them, and ways you can practice with your team. The end goal will be the start of your organizations incident response plan!

Researchers tracking a group called Nimbus Manticore documented a campaign in which attackers posed as recruiters on LinkedIn, approached people with plausible job offers, and sent a coding challenge as part of the interview. However, the challenge carried malware. The entire sequence including the profile, the conversation, the enthusiasm, the technical test existed to get one person to run one file.

What makes recruitment such an effective cover is that it is normal to have unusual behavior. A stranger contacting you out of nowhere, moving the conversation to a private channel, asking you to download something, requesting discretion so your current employer doesn’t find out. Each one of those would look alarming anywhere else, but all of them are ordinary in a job search.

The same principle drives a version of scam now hitting small businesses hardest: a phone call in a voice you recognize. Convincingly cloning a voice takes a surprisingly short sample, and there is plenty of material in any recorded meeting, voicemail greeting or social video. The call is brief, mildly urgent, and asks for something small. It asks you to approve this, confirm that, and read me the code that just arrived.

Takeaway: The thread running through all of this is that identity has become the weak point. Every channel that proved that somebody was who they claimed (their voice, their face on a video call, their email address, their number on your screen) can now be reproduced convincingly and cheaply. The answer isn’t to become suspicious of everyone, which is exhausting. It’s to make sure nothing important ever rests on recognizing somebody. Starting with the place an impersonator often calls first, which usually isn’t you. That’s this week’s habit.

Last week’s rule was about money and never changing payment details because an email told you to. This week’s is the same idea applied to access. One of the quickest ways into a business isn’t an attack on a computer. It’s a phone call to whoever resets passwords. New phone, locked out, about to board a flight, could you reset my multi-factor? If that call works, the attacker is handed a working account and never has to phish anybody.

The habit is a rule for whoever handles those requests, whether that’s your IT provider or the one person in the office who holds the admin password. Password resets and multi-factor resets should never happen on the strength of a familiar voice, a plausible story, or details anybody could look up. A name, job title, manager and start date can all be surmised from a profile on LinkedIn. The check has to rest on something an impersonator can’t research such as a call back to the number already on file, a manager confirming by a number they already have, or a request made from inside an account the real person is still signed in to.

The part most owners miss is that the pressure comes from inside. Staff who are locked out want it fixed now, and a help desk that slows them down gets complained about. A provider that makes your own people prove who they are is doing exactly what you pay them for. One that resets a password because the caller sounded stressed and senior will do the same for an attacker who sounds like you.

Takeaway: Ask your IT provider one question this week: “What does somebody have to prove before you reset a password or multi-factor login for one of our staff?” A good answer names a specific check, such as a call back to the number on file or approval from a named manager. If the answer is “we’d recognize them” or “they’d confirm their details,” ask them to add a verification step, then tell your team it exists before they find out on a bad morning. If somebody in-house handles resets, the same rule applies to them. The rule should apply to everyone including the owner of the business because they’re the most likely to be impersonated.

Take the answer your provider gave you, or the process your in-house person follows, and pick one employee. Ideally, someone with access to sensitive data such payroll or customer data. Spend ten minutes looking at them the way an attacker would: your website’s team page, their LinkedIn profile, your company’s social posts, anything publicly available online as well as their voicemail greeting on their extension.

Write down everything a stranger could learn such as full name, job title, manager, roughly when they started, which office they work from, and what their voice sounds like. Then hold that list up against the reset check. If every question the help desk asks can be answered from the list, the check verifies nothing. It only confirms the caller did their homework.

Confirming your name, your title and your manager used to be a welcome check to verify who you are. However in the world of online presence, this is information that can readily be found with something as simple as someone’s name and the city they live in. The fix is simple. Move the verification check to something outside the public record like the callback number on file or a known person confirming directly such as a manager.

Takeaway: Run through the practice with one person in mind this week. Determine if your reset checks pass the public information test or if you need to add specific steps to improve the check. Build the new steps into your onboarding. When somebody new starts, confirm their callback number is on file and make sure their direct manager is noted with whoever does resets. It’s an easy way to make sure your identifies are protected!