Tips and guidance on cyber security and being vigilant when working with emails and text messages.
Important
If you click on a link or open an attachment in a phishing email call the National Service Desk on 0818 300 300 immediately
Phishing
Phishing is when cyber criminals try to trick you into clicking on links within a scam email or text message.
Email phishing
Email phishing is a targeted cyber attack using a disguised email.
These emails may look genuine, but are actually from cyber attackers trying to access systems for malicious purposes.
Text message phishing
Text message phishing is a cyber attack using a disguised text message. The text message may look genuine but is actually a cyber attacker trying to access systems.
We tend to click on links in text messages quicker than in emails. You should be extra vigilant when opening links within text messages.
Warning signs
- Do you know the sender of the email or text?
- Were you expecting the email or text – is this a normal form of communication or does something seem unusual?
- Does the email address display correctly? For example, first.second@hse.ie is legitimate but first.second@hse-ie.com is not. Check the email address by hovering your mouse over the ‘from’ address
- Does the email or text have a sense of urgency? That something is too good to be true?
- Is there bad grammar and spelling?
- Is the email or text advising you to do something urgently? For example, for financial gain or a request for action so you don't lose a service?
- Does the email or text have links to click on for next steps?
- Is there an attachment on the email? Make sure the file is a recognised Word, Excel, PDF file that you would usually expect
Email and text dos and don'ts
Do
-
Always check the address that the email has been sent from. Is it from someone you usually communicate with?
-
Be wary of any email that you are cc’d on where you don’t personally know the other people it was sent to
-
Check the time an email arrived at - did it arrive at an unusual time?
-
Always check the subject line - is it a reply to something that you never sent or requested?
-
Always hover your mouse over any link in an email and check that the link matches the address shown on screen. You should also check that the address is spelt correctly, and isn’t a fraudulent copy
-
Be careful what you post to social media, online forums and web chats
-
Limit the use of business email for personal use
-
If you think you have received a suspicious email or text message, take a screenshot so you have a record of it
Don't
-
Do not click on any suspicious links in emails or text messages
-
Do not open attachments in unsolicited emails
-
Do not run an attached .exe file. Be wary of .zip files unless you were expecting them. Never click 'run macros'
-
Do not create distribution lists containing both internal and external addresses
-
Do not 'reply all' to group lists without checking the potential recipients
-
Do not forward chain letter emails
-
Do not click on a URL contained in an unsolicited email
Your login details must be kept private. This helps to keep data secure for our patients, service users and staff.
What to do if you think you have been phished
Ask yourself:
- Does the email have any of the characteristics listed on this page?
- Was I expecting this email
- Do I know the sender? If you do then phone them to confirm the validity of the email.
If you suspect the email is a phishing email:
- don’t click on a link or open any attachment.
- delete it immediately.
If you click on a link or open an attachment in a phishing email call the National Service Desk on 0818 300 300 immediately for guidance.
Keeping data secure
Your login details must be kept private. This helps to keep data secure for our patients, service users and staff.
You are responsible, when logged in using your credentials, for activities on HSE devices, information systems and applications.
Do
-
Only use accounts and passwords assigned to you (except for generic and group accounts)
-
Ensure that logins for generic and group accounts are kept confidential and not shared with colleagues or third parties
-
Change your password immediately if you suspect your password is known by others
Don't
-
Do not send your password within email messages, unless the email message is encrypted
-
Do not write down your password on or near your computer or any device connected to a HSE network. In exceptional circumstances where a password has to be written down, it must be stored in a secure place that is not easily accessible to others
-
Do not change default passwords given by suppliers of new devices and systems - this should be done at installation
-
Do not misuse passwords or give a user system privileges above those they're authorised to use
Passwords
Tips for creating strong passwords:
Do
-
Use a combination of upper and lower case letters
-
Use at least 2 special characters such as €, $, %, @, #, ?, !
-
Use at least 2 numbers
-
Use at least 8 characters in total
Don't
-
Do not use a word that is spelled in full, including words spelled backwards
-
Do not use a word spelled in full with numbers added to the end, like deer2000, password2012, or Paul2468
-
Do not add special characters to make the password look like a word, such as p@ssw0rd, or g0ldf1sh
-
Do not use names of people, places or organisations
-
Do not use common keyboard sequences, like qwerty
-
Do not use personal information such as your username, address, date of birth, HSE personnel number, car registration number, or telephone number
-
Do not use sequences like 12345678, abcdefgh, or abcd1234 and instead use a variety of jumbled numbers and letters
-
Do not use this sequence of letters: passwrd, passwd, pwrd, paswd, passwd
Keeping passwords safe
Keep your passwords confidential. Don’t share them with others, including co-workers or third parties. Never write them down on or near your computer devices. If you suspect that your password is known by others, you must change it immediately.
Change default passwords at installation. Make sure you only use accounts and passwords which have been assigned to you.
Find more information on data protection policies and procedures
Social media
The National Cyber Security Centre advises that TikTok should not be on any public sector device because of concerns about security and data privacy. If you have a HSE device you must delete the TikTok app from it.
QR code phishing emails
QR code phishing is a deceptive technique where cybercriminals use QR codes to redirect people to phishing websites. These websites trick users into disclosing sensitive information such as login details, or asking them to download harmful files or documents. This type of threat can lead to data theft and be a route for ransomware delivery.
Be cautious of emails from unknown or unexpected sources containing a QR code.
If you receive a suspicious email, you should:
- avoid clicking or scanning QR codes with your mobile device
- contact the sender through a trusted communication channel to verify the request is legitimate
- report it to the National Service Desk (NSD)
If you have accidentally accessed a QR code in a suspicious email, you should:
- disconnect your device immediately from the network (VPN, LAN or tethering from mobile)
- avoid shutting down or turning off your device
- contact the National Service Desk on 0818 300 300 immediately for further guidance
Contact
National Service Desk phone 0818 300 300