- If a computer is used by different people – for instance, a shared laptop for presentations – it should still have a strong password if it connects to your work network. If possible, don’t connect to the work network because that increases the risk.
- Use different passwords for accounts that provide access to restricted information than for less-sensitive accounts.
- Change passwords regularly.
- Install anti-virus, anti-malware and anti-spyware software and make sure it is always up-to-date.
- Don't click on unknown or unexpected links or attachments because these can infect your computer.
- Don’t open files sent via IM (instant messaging) or P2P (peer-to-peer) software on a machine that contains restricted data because these files can bypass anti-virus screening.
- Don't install unknown or suspicious programs on your computer because these can be computer viruses or open a “back door” giving others access to your computer without your knowledge. Consider restricting the ability to install software.
An online recruitment agency accepted CVs from jobseekers and made them available to employers on a password protected website.
Jane, a jobseeker whose CV was on the website, received an email which she suspected was a 'phishing' email. The email was personalised and contained information from her CV. It contained a number of spelling mistakes and offered her a job. The email claimed that all Jane had to do to secure the job was to provide her bank account details so she could be paid. Jane told the recruitment agency of her suspicions, and forwarded a copy of the email to the agency.
The recruitment agency then assigned a member from its IT team to investigate. The investigator discovered that the email was indeed a phishing email. It claimed to be from an employer and directed the jobseeker to a website that asked them to enter further information. It also installed spyware on the jobseeker's computer.
The recruitment agency then attempted to establish how phishers came to have the CV details of the jobseeker. The preliminary assessment revealed that the phishers had stolen legitimate user names and passwords from employers who used the agency's website and that the phishers had fraudulently accessed jobseeker information.
The IT team brought the problem to the attention of senior management and quickly contained the breach by disabling the compromised employer accounts. Based on the IT team's assessment, senior staff moved to evaluate risks associated with the breach and considered what actions should be taken to mitigate any potential harm.
The recruitment agency then upgraded the security on its website to prevent future breaches of employer and jobseeker information. To prevent a similar breach, it also informed employers that used its services that it had put in place stricter log-in protocols.
A popular Australian online gaming service sold access to its gaming network on a subscription basis. It collected and held a range of personal information from its customers in order to create a user account and deal with subscription payments. Details included names, dates of birth, email addresses, postal addresses, and credit card numbers.
During a routine security check, the gaming service discovered through the use of intrusion detection software that the server containing its account information had been compromised, and the account information of over 500,000 customers had been hacked and, most likely, copied.
The gaming service took immediate steps to contain the breach (including temporarily shutting down its servers) and notified the Australian privacy authority. Based on its belief that criminal activity had been involved, it also contacted Police.
Police then investigated, during which time they asked the company not to release any information about the breach. The company also engaged a technology security firm to enhance the security of its accounts systems.
When Police were satisfied it would not compromise their investigation, the company notified the affected customers. It explained exactly what happened an