The Reconnaissance · week 1 of 52 · 3 min read
Welcome to Cipher's World
The story your team reads in week 1, word for word as in the app. Free, no account needed. Below it is the first question from that week’s quiz.
In the photo everyone is smiling. Behind them the whiteboard is still full.
It's a team photo from a Friday afternoon. Cake on the table, twelve people looking at the lens, someone holding up a glass. On LinkedIn it says underneath that the migration is finally behind them.
I'm not looking at the people. I'm looking at the whiteboard behind them. In blue marker, just legible: Phase 3, Almeco integration, live 14/11. Below it three initials and an arrow.
That's usually how it starts. Not with a leak and not with a password, but with someone who's proud of their work.
I'm not looking for secrets
I have nothing against you. I don't even know you. I'm looking for an organisation worth the trouble and ordinary enough not to pay extra attention.
Novento Groep is such a company. Two locations, just over eighty people, a website that's kept up neatly. Beyond that I know nothing yet.
So I read on. The vacancies page gives away which package the finance department works with, because they want someone experienced in it. A press release names a supplier. An old presentation shows how the department was organised three years ago and who led it then.
Separate pieces. Nobody did anything wrong.
But I lay them side by side, and a map appears. Not a network map. A map of how the work flows: who's in charge of what, who talks to whom, which supplier is known, which project is in a hurry.
And on it, one name keeps returning.
Sandra
Sandra isn't careless. I see no password on a note and no strange messages. She does her work well: she processes invoices, knows the suppliers, and whoever wants something arranged quickly drops by her desk.
That's why the organisation knows her. And that's why it works the other way too: if something comes from Sandra, nobody thinks about it for long.
That trust isn't a fault. Without trust no work gets done. It's just exactly what I need.
Organisations like to look for the weakest link. The one who clicks too fast, who doesn't pay attention. I look for something else.
I look for who can make something happen.
What makes a request credible
A logo can be copied. A signature too. A writing style, these days, as well.
Those aren't the parts that do the work.
The work is done by the things that are right. The project name that really exists. The supplier you really use. The date that fits something you were already busy with that week.
Then you don't read a message as "what is this". You read it as "oh yes, that".
That half second is what I live on. Not your carelessness, but your routine.
For now I touch nothing
I don't send a mail yet. I don't call the service desk. I don't try to log in anywhere.
So for Novento nothing happens this week. No alarm, no report, nobody who can pass on anything suspicious. My visit to a website looks exactly like an applicant's.
That's what makes this phase uncomfortable. There's nothing to notice, and yet I know more every day.
Sandra doesn't know her name is in my notes. She doesn't know I exist.
Next week I'll still be watching. Only no longer at the organisation, but at the language you use, and at what people give away with it without noticing.
After the story: The red quiz: recognise the attack
After the story your team takes the red quiz: 5 questions on how this week’s attack works. This is the first one, as your team gets it in the app. Then comes the blue quiz, on how to stop the attack.
Why does cybersecurity concern every employee, even without a technical role?
- Because employees are personally responsible for the technical security of all company systems.
- Because cyber incidents mainly start with employees who have little computer experience.
- Because almost every employee works with messages, data, accounts or business requests.
- Because security software only works after employees have personally recognised an attack.
Coming up · week 2: The language of an organisation
Cipher now has one name. Next week he works out how Novento talks. "You write my dictionary for me." Let your team read along: a new chapter and two short quizzes every week, about ten minutes in all.