Major Operating System upgrades are usually a cause of confusion among end-users and the current Windows 10 upgrade is no exception. The bad guys exploit these confusions in several ways, mostly through massive phishing campaigns and with criminal call-center operations which claim to be Microsoft tech support.
Some campaigns will try to worry the user that their PC has changed somehow, causing access issues. Other phishing emails will try to lure the user with links where they can get their new no-charge version of Windows 10, or have it "attached" in a zipped file, which makes it our Scam Of The Week, because the attachment is the CTB-Locker ransomware!
Unfortunately there are no limits to criminal inventiveness. So, I suggest you send something like the following to your end-users and/or friends and family. Feel free to copy/paste/edit as needed, per your own policies related to OS upgrades:
"Microsoft is in the process of releasing their new Windows 10 Operating System. This is an upgrade that you do not pay for, promises to fix problems with earlier versions, and claims to be more secure. They plan to upgrade a billion personal computers, causing inevitable confusion among PC users.
"Bad guys are trying to exploit this confusion. You might get calls from scammers that claim to be Microsoft tech support and try to charge you for the upgrade using your credit card.
"Be very careful with any email claiming to be from Microsoft about "your Windows 10 Upgrade". Make sure that any links in the email really go to Microsoft. Better yet, do not click on any link or open any attachment, but go to the Microsoft website for more information." Here is the link:
http://www.microsoft.com/en-us/windows/windows-10-upgrade?
For KnowBe4 customers, we have a new template in the IT section called "Windows 10 Upgrade Error". We think it would be wise to send this template to your users and inoculate them against this type of social engineering as soon as possible.
Regarding Win10 itself I would hold off upgrading your users wholesale until a LOT of field testing has been done. I am running it on a machine at the house and there are good reasons not to rush into the upgrade, because of some of new features like the "Windows Update Delivery Optimization (WUDO) which works like torrents do, and makes your Win10 machine part of a peer-to-peer network delivering Win10 to other users using your bandwidth, and the new "Wi-Fi Sense" which makes Wi-Fi more available and accessible - for better or for worse.
In theory, someone who wanted access to your company network could befriend an employee or two, and drive into your office parking lot to be in range, and then gain access to your wireless network with this new update. See Brian Krebs' post about it over at Krebs on Security.
Also, apart from being a "security upgrade", Win10 also grabs all information it can get its hands on, this version is incredibly intrusive by default. Just open Settings and click on Privacy. There, you’ll find 13 different screens — yes, 13 — to go through, and you’ll want to disable anything that seems worrying, you should definitely adjust what types of data each app on that box can access.
If you aren't a KnowBe4 customer yet,
find out how affordable Kevin Mitnick Security Awareness Training is and be pleasantly surprised:
