ORIGIN holds clients' confidential plans, and attackers know it. These habits keep one careless click from exposing a client, and nobody is blamed for reporting quickly.
Set up, on your first day
Check that two factor authentication is on for every ORIGIN tool, and turn it on where it is not. It asks for a code from your phone as well as your password, so a stolen password alone is useless. It is mandatory.
Use the company password manager. Any login you create for ORIGIN is shared only through it.
Keep ORIGIN and client data on approved tools only. No personal email and no personal cloud storage.
What never travels by chat or email
Passwords, login details or payment details. Not on WhatsApp, not in email, not in Asana, not in a screenshot.
Client payment information, which never sits on a personal device.
You create a login for a client's campaign tool. A colleague on the engagement needs it too. How do they get it?
A login is shared only through the password manager.
Two factor on everything.
Every email, and anything suspicious
Three checks, before you act on an email
- 1Check the sender's address, not only the name. A real ORIGIN email ends in @origin.global.
- 2Be suspicious of urgency, and of any request you were not expecting.
- 3Do not open links or attachments from a sender you cannot confirm.
The trick we see most: fake emails written in our founder's name, asking for a favour or a quick task. The name looks right. The address does not. If you receive one, do not reply, do not do what it asks, and tell your line manager straight away.
An email arrives from "our founder" asking you to buy gift cards before noon and keep it quiet. The address ends in a public mail service. It is fake. Report it to your line manager.
If something looks suspicious
- 1Stop. Do not click, reply or forward.
- 2Tell your line manager straight away, especially when it is a request you did not expect.
- 3If you already clicked, say so at once.
Speed matters more than embarrassment, and nobody is blamed for reporting quickly.
You clicked a link in an email, and the page that opened looked wrong. Nothing else seems to have happened. What do you do?
If you already clicked, say so at once.
Check the address. When in doubt, stop and tell your line manager.
Your first week with these tools
Seven things to do this week
Check two factor authentication on every ORIGIN tool, and use the company password manager.
If a tool or an account is missing, ask People & Culture.
Ask your line manager which time tracker applies to you, HubStaff or UpWork.
Know your theater and your clock.
Every day, make sure your Asana tasks are current before you stop work.
Copy ASALA on every email you send for ORIGIN.
Ask your line manager to show you the Claude routines for your role.
It is your first week, and you cannot get into a tool your role needs. Who do you ask?
Accounts, logins and tools: People & Culture.
A tool or an account is missing? Ask People & Culture.
Before you move on
Three questions before you move on. Type your answer, send it, then check it.
Your answers stay on this device.1What does two factor authentication ask for?
The answerA code from your phone as well as your password.
2How does a real ORIGIN email address end?
The answerIn @origin.global.
3Something looks suspicious. What do you do?
The answerStop. Do not click, reply or forward. Tell your line manager straight away.
You know how ORIGIN runs.
We are a team of high performers, and you are expected to achieve from your first month. Do these seven things this week. Next: the Act 07 quiz. After it, the final exam.