Reporting a Security Incident at Work: Whom and How

One day you will click on something you should not have, lose a laptop or notice something odd in your mailbox. What you do in the next few minutes matters more than what went wrong. In this lesson you will learn what counts as a security incident, why speed beats perfection, whom to contact, and exactly what to say, so that a small problem stays small.

The previous lessons of this chapter were about prevention. This one is about the moment prevention fails, which it will, sooner or later, for everyone. Security teams do not expect a world without incidents. They expect a world where incidents are reported quickly.

What is a security incident?

A security incident is any event that compromises, or could compromise, the confidentiality, integrity or availability of information or systems. Put simply: someone who should not see data might have seen it, data might have been changed or destroyed, or systems might have stopped working. Examples at the level of an employee:

• You clicked a link in a phishing email, opened a suspicious attachment, or entered your password on a page you now doubt.
• You received a suspicious message or call that you did not fall for, such as fake IT support or boss fraud. (This is a report that helps colleagues, even if you did nothing wrong.)
• A laptop, phone, USB drive, badge or document has been lost or stolen.
• You sent an email or file to the wrong recipient, or shared a folder too widely.
• Your computer behaves strangely: unexpected pop-ups, programs you did not install, files renamed, a ransom note.
• You noticed someone unfamiliar in a restricted area, or someone asking for information they should not need.
• You suspect that your account has been used by someone else: strange sent messages, unexpected sign-in alerts, approvals you did not request.
• You discovered that sensitive information is accessible to people who should not see it.

The key concept is suspicion. You do not need to be sure that it is an incident. If you are wondering, that is already enough to report.

Why speed matters so much

In many attacks, time is the attacker's best friend. In a few minutes after a stolen password is used, an attacker can set up forwarding rules, send phishing messages to your contacts, or start encrypting files. Each hour that passes expands the damage and makes the recovery more expensive.

Think of a small fire: a bucket of water at the beginning is enough, and a fire brigade is needed an hour later. The company's security team can only act when they know, so the single most valuable thing you can do is tell them quickly, with the facts that you have.

There is also a legal dimension. Under the GDPR, an organization must notify the data protection authority of certain personal data breaches within 72 hours of becoming aware of them, and sometimes inform the affected people. That clock may start from the moment someone in the organization knew. A delay in reporting internally can therefore create real legal trouble for the company.

Whom to contact

The security policy should tell you who to call. Typically it is one of:

• The IT helpdesk or the security team (often a dedicated email address, phone number or "report phishing" button).
• The security manager (RSSI or CISO), in smaller organizations, your manager or the person in charge of IT.
• The data protection officer when personal data is involved.
• Your manager, who should also be informed and who can help escalate.

Use the official channel in the policy, and a phone call for urgent matters, since an email may take hours to be read, or may be unavailable if the account is compromised. Save the contact details on your phone, before you need them. If you are not sure whom to call, call the helpdesk and say it is a security matter: they will route it.

What to do in the first minutes

The ideal order is simple and short:

1. Stay calm. Do not panic and do not hide it. The incident is not the failure; concealment is.
2. Stop what you are doing on the affected device. Do not keep clicking, closing windows or trying to repair the issue with random tools.
3. Disconnect if you suspect malware or ransomware. Unplug the network cable, switch off Wi-Fi and Bluetooth, but do not switch off or restart the machine unless told to, as this can destroy useful evidence. Follow the instructions given in your policy.
4. Report immediately to the contact above.
5. Do not delete anything. Keep the suspicious email, file or message, as the investigators will need it. Do not forward a suspicious email to colleagues unless instructed; use the reporting function.
6. Follow the instructions you are given, and write down what you do.

What to say: a short report template

A good report contains facts, not guesses. A few lines are enough:

What happened: I opened an attachment in an email claiming to be an invoice.
When: Today at about 10:15.
Where: My work laptop, via the corporate mailbox.
What I did: I clicked "enable content", then closed the document.
Current state: The laptop is disconnected from the network.
Other: I did not enter any password. I kept the email.
Contact: My mobile number is on the staff list.

If you are unsure about some details, say so. "I do not remember exactly" is a useful and honest answer.

What happens after you report

Organizations usually follow an incident response process with stages that look like this: detection (your report), assessment (is it serious, how far did it spread?), containment (isolate the device, disable accounts), eradication and recovery (clean systems, restore from backup) and a review afterwards to learn lessons. You may be asked to hand over your device, change your passwords, answer questions or help to identify other people who received the same message. Cooperate fully and promptly.

You will also usually be thanked. A good security team would much rather receive ten false alarms than miss one real incident.

Building a reporting culture

• Report near misses: the phishing email that you noticed in time may be received by 200 other people. Your report lets the team remove it from their mailboxes.
• Encourage others: if a colleague confesses a mistake, react kindly, and help them to report.
• Do not hide mistakes, yours or others': a concealed incident can grow into a major one, and hiding it can be worse than the mistake itself.
• Know the process before you need it: read the procedure, and take part in drills or awareness sessions.

Outside the company

For personal incidents, such as the compromise of a private account, the resources are different, and we will look at them in Chapter 7. For work incidents, though, your first contact is always your organization, which has the means and the obligations to deal with it and, if needed, to notify authorities such as the French agency ANSSI (cyber.gouv.fr) or the data protection authority.

Your turn

Exercise. For each situation, say whether you would report, to whom, and what the immediate action is.

1. You receive an email from "the CEO" asking you to buy gift cards urgently. You did not reply.
2. You left your work phone in a taxi.
3. You clicked a link in a "shared document" email and typed your work password into the page that appeared.

See a solution

1. Report. Use the phishing report function or forward the email to the security team, as the policy says, and tell your manager. Do not reply or buy anything. Your report may protect colleagues who received the same message.
2. Report immediately to the IT helpdesk or security team by phone, so that they can locate, lock or erase the phone remotely, and block the SIM card. Change the passwords of accounts used on it if instructed.
3. Report immediately by phone. Say that you entered your password into a suspicious page. Change your password from a clean device as instructed, since the team may also need to review the activity on your account and revoke active sessions. Do not wait to see whether something happens.

Add to your Security Notebook

Under "6. Security at work", write the phone number and email of your incident contact, the three situations in which you will report at once, and your own six-line template. Save the contact on your phone now.

That completes the chapter on security at work. In the final chapter, we turn to the moment everyone dreads: what to do when your own accounts or devices have been compromised.