Cyber Security Professionals
Develop and implement cyber security standards and guidelines, develop and install cyber security software and systems, conduct risk and security control assessments, analyse and address vulnerabilities in digital infrastructure, and respond to cyber security incidents.
Friday afternoon, 4:50pm alert
You are a cyber security analyst on a small security team, and you are the only analyst still online on a Friday afternoon. It is 4:50pm. A monitoring alert shows an unusual login to a staff account from another country, at a time when that person is meant to be asleep. Half the company has already left for the weekend.
Choose what you would do. Then see what happens. There are often good reasons for each choice.
That account belongs to a senior accountant. The alert could be real or it could be her using a phone on holiday. I'd rather not wake her unless it's serious. What do you want to do before we leave?
Ignore it until Monday, since it could easily be a false alarm and nobody wants a weekend call-out
On Monday you find that the login was real and has been quietly looking through files all weekend. A false alarm is a guess, and the weekend gave someone time.
Phone the accountant, ask whether it was her, and lock the account if she cannot confirm
She was not abroad, and she is grateful for the call. You lock the account, reset her access and note exactly what happened. You act on a small doubt before it becomes a big problem.
Lock the account and tell no one, then look into it properly on Monday morning
The account is safe, but the accountant arrives on Monday unable to log in, and her manager is unhappy. Taking action is right, and telling people is part of the action.
If you lock that account, the weekend freight bookings will stall. We have customers waiting. Can't you just watch it instead? I really can't have the system going down tonight.
Tell him the decision is yours and the bookings will have to wait until the account is safe
You are right about the risk, but the bookings stall for hours and he escalates to the company's director. Winning the argument does not help if people stop listening to you.
Agree to watch it for now, and lock the account only if something else suspicious happens tonight
Bookings keep flowing, but you are now watching a possible intruder with the door open. Two hours later, you are forced to lock it anyway, with less time to prepare.
Explain the risk, set up a limited workaround for the bookings and lock the account
Gareth is irritated, then relieved when you show him the workaround. Bookings continue and the account is closed. Good security finds a way to keep the business moving.
I need a quick summary for the director. She wants to know if this is a breach, in one paragraph. I know it's early, but I don't want to say anything wrong. What should I tell her?
Tell her what you know, what you do not yet know and what you are doing next
The director appreciates the straight answer and sets a time for an update on Monday. Being honest about what is unknown builds the trust you will need in a bigger incident.
Tell her it is a confirmed breach, so she takes it seriously
She takes it seriously, but you do not yet know that, and the company starts a heavy response over a risk that is still being checked. Accuracy matters in both directions.
Tell her it is probably nothing, so she can relax for the weekend
She relaxes, but the facts do not support it. When you find more on Monday, the director feels misled and starts asking who decided what.
How it went
The account was locked, the bookings kept moving and the director got an honest summary. Cyber security is part detective work, part communication and part judgement about risk, usually under time pressure and with incomplete information. Would you enjoy being the one who gets the call?
This is a simplified, fictional situation to help you explore. It is not professional instruction or a test of your ability.
Case study: The email that a receptionist reported
A fictional case set in the security team of a fictional freight and logistics company, working from an office and a monitoring room.
The situation
Noor worked in the security team of Harbourline Freight, a fictional logistics company. On a Monday morning, a receptionist named Pete forwarded an email that looked like it came from the finance director, asking for urgent payment details. Pete was worried that he might have done something wrong, because he had clicked a link before he got suspicious. Noor knew that Pete might hide it if he felt in trouble, and that three other staff had received the same message.
What they did
Noor rang Pete straight away and thanked him for reporting it so fast. She asked him calmly what he had clicked and when, and she did not mention blame. With her team, she checked whether the link had done anything, blocked the message for everyone and warned the other staff. That afternoon she sent a short note to the whole company: what the email looked like, and a promise that anyone who reported something would be thanked.
How it turned out
The link had been caught before it did any harm. Two more people reported similar emails over the next fortnight, which Noor took as a sign the message had landed. Pete was embarrassed for a day and then proud that he had been the one who spoke up.
What would you do?
- Why might thanking someone for a mistake be a clever security move?
- Would you enjoy spending your day thinking like someone who wants to cause trouble?
- How would you explain a security risk to a busy person who does not care about technology?