All tabletop exercises
Email / BEC·Starter·Mixed audience
Payroll diversion through HR self-service
The prompt — read this to the room
On payday, three employees tell HR they have not been paid. In each case the HR self-service portal shows their bank details were changed eight days ago, from a sign-in that passed MFA. One employee remembers clicking a 'benefits enrolment' link in an email. This month's payroll file has already gone to the bank. Two more employees' details changed yesterday, and next week's contractor run is being prepared now. The affected staff are upset and want to know when they will get their money. What do you do today?
Total duration
1 h
People to involve
5
Best fit
Education, Healthcare
Who to involve
Most important first.
- HR
- CFO / Finance
- IT operations
- SOC analyst
- Customer support
What it tests
- Freeze further bank-detail changes and verify recent ones through a separate channel.
- Pay affected employees quickly and decide who absorbs the loss.
- Scope the phishing campaign and the compromised accounts.
- Add a control on bank-detail changes that does not rely on the account itself.
Outline of activities
- 1Payday: three people unpaid
- 2Stopping further diversions
- 3Making employees whole
- 4Scoping the campaign
- 5Hot wash
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…