Incident Reporting and Security Culture: See Something, Say Something
By: Heather Lange-Wilson
A cybersecurity incident does not always begin with flashing
warnings or obvious ransomware messages.
Sometimes it begins with something small.
An unexpected MFA request.
A suspicious email.
A laptop that suddenly behaves differently.
A document accidentally sent to the wrong person.
A phone call asking for information that normally would not
be requested.
The speed at which these events are reported can make a
significant difference.
What Should Employees Report?
Employees should follow organizational procedures for
reporting situations including:
- Suspicious
emails
- Unexpected
MFA requests
- Lost
or stolen equipment
- Malware
warnings
- Accidental
information disclosure
- Unusual
account activity
- Unauthorized
software
- Suspicious
phone calls
- Unknown
people in restricted areas
- Unexpected
changes to files
Employees do not need to determine whether something
officially qualifies as an incident before reporting it.
Report the concern and allow the appropriate team to
investigate.
Why Speed Matters
Suppose an employee accidentally enters credentials into a
phishing website.
If the employee reports it immediately, security personnel
may be able to:
- Reset
credentials
- Terminate
active sessions
- Review
account activity
- Block
malicious infrastructure
- Search
for similar phishing messages
If the employee waits several days, attackers have
additional time to use the compromised account.
Reporting quickly gives responders options.
Do Not Hide Mistakes
People make mistakes.
Clicking a suspicious link and immediately reporting it is
far better than hiding the mistake.
Employees sometimes hesitate because they are embarrassed or
afraid of consequences.
A security culture that makes people afraid to report
mistakes may unintentionally increase organizational risk.
Accountability remains important, but so does early
communication.
Preserve Evidence
Employees may instinctively try to clean up a suspected
incident themselves.
That can sometimes destroy useful evidence.
Unless instructed otherwise, employees should avoid actions
such as:
- Deleting
suspicious messages
- Wiping
devices
- Removing
files
- Reinstalling
systems
- Conducting
their own investigation
Follow established procedures and instructions from
authorized responders.
Know the Reporting Process
Every employee should know how to contact the appropriate
team.
Reporting mechanisms might include:
- IT
service desk
- Security
team
- Dedicated
phishing-reporting tool
- Hotline
- Incident-reporting
portal
Organizations should make these methods easy to locate and
understand.
Near Misses Matter Too
Not every reported event becomes a security incident.
Suppose an employee recognizes a convincing phishing email
before clicking anything.
Reporting it can still help.
Security teams may discover that hundreds of employees
received the same message and can take action to remove or block it.
A near miss can provide valuable threat information.
Security Culture
Security culture describes how people throughout an
organization think about and behave toward security.
A strong security culture encourages employees to:
Ask questions.
Verify unusual requests.
Report problems quickly.
Follow established procedures.
Learn from incidents.
Security becomes part of normal work rather than something
handled only by IT.
Knowledge Check
1. Should employees wait until they are certain an
incident occurred before reporting suspicious activity?
A. Yes
B. No
Answer: B
2. Why is early reporting important?
A. It gives responders more opportunity to contain potential
damage.
B. It guarantees no incident occurred.
C. It eliminates security training.
D. It replaces backups.
Answer: A
3. Should employees delete suspicious messages before
reporting them?
A. Always
B. Follow organizational procedures and preserve potential evidence when
appropriate.
Answer: B
4. Why are near misses useful?
A. They can reveal threats before additional employees are
affected.
B. They should always be ignored.
C. They eliminate risk.
D. They replace incident response.
Answer: A
Security+ Quick Review
Incident Reporting = Communicating suspected security
events through approved channels
Evidence Preservation = Protecting information that
may assist an investigation
Near Miss = An event that could have caused harm but
did not
Security Culture = Shared organizational attitudes
and behaviors toward security
Final Takeaway
You do not need all the answers before reporting a security
concern.
If something looks wrong, report it.
A five-minute delay may not matter—but sometimes it does.
Early reporting gives the security team the best opportunity to protect
accounts, information, systems, and other employees.
