As much as we try to make our systems as robust as possible, sometimes we’re over-ridden by human failure. All good tech support workers will have created really secure systems to help protect organisations from the effects of malicious software (malware) trojans and viruses getting into their IT systems via emails, and they also try hard to stop scammers from fleecing money from their organisations by using a range of filters to weed the dodgy emails out, but unfortunately it doesn’t always work.

It’s usually not the tech system that fails – it’s the humans sitting in front of their computers that do the damage. In the industry there’s an expression known as PEBCAK - Problem Exists Between Chair and Keyboard. Actually, there are lots of similar expressions which have been created by frustrated IT support people, and to be fair, they probably have a point!

A quick Google search will identify scores of scams, along with stories of gullible people who have been taken in by someone who is smarter than them, and chances are, money will have been lost in the process. Often there are warnings in the media about scams that are doing the rounds, however not everyone heeds them. The same applies to allowing trojans and viruses in.

Opening an email isn’t harmful. Desktop and Web-based email programmes no longer support scripting languages, such as JavaScript. In the past, these scripts would allow email messages to be more interactive, but they also let cybercriminals insert malicious codes and exploit vulnerabilities, so support was discontinued. Most email programmes default to block images from unknown sources, which provides a level of safety. However, it doesn’t end there, and you need to be on the look-out for phishing attacks which can lead to malicious attachments.

You also need to be aware of suspicious links and attached files and you must never open them. By following this advice, your computer will not get infected by malware. Unfortunately, this isn’t always the case with some of your ‘trusted’ contacts who have inadvertently opened things they shouldn’t have, been hacked, and are now exposing you to these unnecessary risks.

Hackers infiltrate email accounts of unsuspecting people and use their accounts to spread malware. If you receive a phishing email from someone you know, you need to let them know about the potential misuse and security breach of their account.

The problem is that some attacks appear very genuine, so in addition to the usual warnings, a few formal employment rules need to be put in place to protect people from themselves. This should be done by an HR practitioner as part of the organisation’s policies and operating rules and included in the employment agreement which both parties sign. However not all organisations have HR as a specific role, so it will often end up being the responsibility of someone else in the organisation, possibly an office or line manager or a supervisor.

A good employment agreement should include how emails should be managed and what penalties might be enforced if this is breached. Most employment agreements cover objectionable material in emails or downloaded from the internet, but few will include a clause about opening attachments and clicking on links that might contain malware, trojans or viruses.

Some larger organisations have a message appear on externally generated emails, which provides an extra warning to the recipients, and this might also be an effective way to alert readers to the potential risk involved, see below.

CAUTION: This email originated from outside [organisation name]. Do not click links or open attachments unless you recognise the sender and know the content is safe.

If you are in doubt whether an email and its links or attachments are genuine, check the file extensions.

A file extension is a full-stop followed by a set of characters that suffixes the name of the file. For example, a ‘.doc’ file extension is used for files associated with word processing documents.

Files with .gif, .jpg, .mp3, .mp4, and other file extensions used by image and video file formats are generally safe to open. Files with .doc, .docx, .pdf, .ppt, .pptx, .xls, .xlsx or other extensions associated with word, spreadsheet or presentation programmes are also usually safe. Document files however, especially DOC and PDF files, can be infected to exploit Microsoft Word and Adobe Reader vulnerabilities, so take care if you receive these files from unknown senders.

So, what happens when the unthinkable happens and you’ve downloaded a potentially dodgy attachment?

Hopefully before you’ve opened it, your up-to-date anti-virus software has scanned it for infection and warned you not to proceed if it has detected any risk. It’s your call whether you proceed or not. It’s also important to keep all software updated, including your email, web browser and operating system software.

If you’re unlucky and your computer is infected, here’s a site with good information to help you to get rid of it - it also goes into a lot more depth than I have, about all things virus-related.

On the other hand, if you’ve fallen for a scam and parted with your hard-earned money it might be “sayonara” unfortunately.

There really isn’t any way back from being scammed once your money has been transferred to the rogue account. A visit to the CERT NZ website provides a huge amount of really helpful information and tells you what you need to do if you’ve been affected by a scam or fraud. You can also report a scam or fraud on their site.

As long as there is email there will be scammers, so the best defence is knowing how these scams can happen and using caution at all times when working with email. If all else fails, there is help available from professionals, but the take-away from this blog has to be “prevention over cure”. The time spent dealing with and recovering from a virus is enormous and will inflict you with a massive distraction for days, weeks and maybe even months to come.

There’s a lot to be said for the old adage “It’s better to be safe than sorry”, especially when it comes to email.

Contact us@expert.services if you would like to discuss staying safe.