article banner
From Where We Sit

The weakest link: A cybersecurity story

Third Librea

“Strange,” he thought, eyeing the unfamiliar flash drive on his office desk. “I wonder who owns this?”
Paul examined the 64-gigabyte device for its name label. He rotated it on his hand. None. Completely generic. “Amazing how they get tinier and tinier,” Paul mused, as he proceeded to plug the smaller-than-his-thumb flashdrive into his four-year old Windows-run machine.

He was being relentlessly badgered by the tech guys to upgrade his laptop for over a year now. But policies and procedures be damned! He was generating more than P200 million in projects every year, so both the sales director and the CEO did not make a fuss but turned a blind eye to the minor company policy infractions.

Besides, his old reliable laptop contained all his important files—draft proposals, contracts, feasibility reports, customer lists, torrented TV shows, and some rather raunchy photos of him and his wife from their last Palawan trip. In no way will he be sending his laptop to IT without doing some housekeeping first and he had no time to back up his stuff in case the tech guys again lost some files, as they did during the last upgrade.

He proceeded to type in his password, and tapped the “Enter” key. The cursor remained blinking in the password field. “Incorrect password again,” Paul angrily realized. With so many passwords to remember, he frequently forgot which password went where. He tried again and was greeted by his haphazardly organized desktop filled from edge to edge with files and folders.

The computer spat several notifications at him, one after the other: 523 unread emails. Disk almost full. Windows updates available. Antivirus engine is outdated. He ignored them all, tapped on the “X” to close all the notification windows, and clicked to open the flash drive.

The lone video file stared at him from the screen: “OFFICE-SCANDAL.mp4”.

Paul stood up in his cubicle and surveyed the room. It was 8:30 p.m. Ross and Lui were still there, busily pecking at their keyboards. The director’s door was still ajar, his lamp slashing a path of light in the dim hallway across. The percolator hissed occasionally as the scent of stale coffee wafted through the room. All clear.

He plugged in his earphones and clicked on the file in eager anticipation.


Another click.

No response.

Disappointed, Paul hovered his mouse over the close button, and, as he did so, his virtual desktop slowly began to shrink, its edges squeezing the frame from all sides until his open windows, files and folders shrank and vanished into a glowing point at the screen’s center, like an old cathode ray TV would do when turned off.

In a combination of surprise, befuddlement and panic, Paul swiped his finger on the trackpad angrily, like a sword slashing uselessly in the darkness.

From deep in the bowels of his laptop, the Trojan horse had begun its nefarious work as soon as Paul had inserted the flash drive. First, a keylogger began capturing keystrokes as Paul entered his password. Then it started looking for network connections and access to the internet. While copies of the office scandal file were being replicated in open folders throughout the network, the Trojan started uploading the contents of Paul’s 500-gigabyte hard drive over the internet to a server outside the country. This continuous stream of data began clogging the company’s internet connection.

“Lui, look at this. My screen just went blank!” Ross said aloud.

As Lui shuffled over to Ross’s cubicle, the director peeked out from his room. “Are your connections ok? I can’t seem to access anything on the web. I think our website is down, too. Can’t access it on my phone. Is IT still around?”

Paul began to mash the buttons on his keyboard, hoping for a response from his computer. Then, just as he was about to give up all hope, a parade of dancing symbols and letters appeared from the left edge of the screen amid a blood-red background, finally settling in the middle of the display in a familiar pattern—the ASCII characters had formed a crude graphic of a skull and crossbones. And directly underneath the symbol, it demanded that Paul “Press Any Key.”

His finger poised tentatively over the Enter key. “What have I done?” Paul asked himself, still uncertain if he should do as his screen instructed. He hesitatingly tapped on the key.

Further instructions appeared in that same crimson background: “The hard disks of your computer have been encrypted with a military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the Darknet page shown in step 2…”

“My files. My emails. The P25 million project proposal due tomorrow. My wife’s photos. Ross’s computer. No internet. Our website is down.” Realization now crashing into his consciousness in an endless stream of profanities, regrets and opportunities lost. And guilt.

And as he ran to the director’s room, it came to him again: the chilling blood red macabre symbol of poison and danger. And Death.

* * *

This short story has been adapted from real events, with creative liberties taken to keep the names and nature of businesses confidential. Cybercrime is real and is here right now in the Philippines, and people are often the weakest link in any organization’s security layers. Why did Paul plug in the flash drive and attempt to open the file? Why did he ignore IT’s pleas to upgrade his machine? Why did his superiors not insist on enforcing the policy? Why did he ignore the operating system and anti-virus update notifications? We may never know the answers to these questions, but running regular security awareness programs so that all personnel are aware of the potential consequences of their actions can help mitigate these risks. Otherwise, the office scandal will be played in your office soon.

Third Librea, Partner, Head of Advisory Services, and Chief Information Officer (CIO) of P&A Grant Thornton. P&A Grant Thornton is one of the leading Audit, Tax, Advisory, and Outsourcing firms in the Philippines with 20 Partners and over 850 staff members. For your comments, please email or For more information about P&A Grant Thornton, visit our website


As published in The Manila Times, dated 02 August 2017