This uni thought it would be a good idea to do a phishing test with a fake Ebola scare University of California Santa Cruz (UCSC) students may be relieved to hear that an emailed warning about a staff member infected with the Ebola virus was just a phishing exercise. The message, titled "Emergency Notification: Ebola Virus Case on Campus," went out to the university community on Sunday, August 18. It began, "We …
"Phishing simulations run a very high risk of creating distrust and friction between your employees and security team,"
In my experience any attempt to implement, highlight or enforce security causes friction, especially with engineers and directors. Make people use strong passwords, making people change passwords, making people use 2FA, workplace audits for post-it-passwords, disabling USB, warnings about stuff on local drives, and so on. I don't see why phishing simulations should be specially different.
"Making people change passwords"
The gift that keeps on giving massive annoyance and weak sequential passwords for no security gain. Debunked many years ago but still forced on us by tick-box warriors. (sorry, touched a nerve)
https://www.ncsc.gov.uk/collection/passwords/updating-your-approach
"Regular password changing harms rather than improves security."
Yes. Passwords are terrible authenticators, but many developers go out of their way to make them even more terrible.
One of the systems I use for work doesn't allow spaces in passwords, making it more clumsy to use passphrases. Another has a (bogus, idiotic) complexity rule of "no more than two consecutive characters that appear in the user's name"; obviously many people have consecutive characters in their names which are also common in natural-language words, so that's also an impediment to using passphrases.
So many IT practitioners simply aren't interested in the research around password/passphrase use and strength, and instead indulge in this cargo-cult false-security nonsense.
Strongly disagree.
A 64 utf-8 character random stream is an amazing authenticator. Lightweight, easy to implement, and completely safe against against anything short of bruteforcing the entire keyspace or using the 5$-wrench-attack.
And all it requires is for people to use a password manager.
My place has minimum 20 chars for user passwords now, so we're all encouraged down the "Correct Horse Battery Staple" type of passwords. It took about a monht for people to get used to it but it's proved way more popular and has cut the number of password calls to helpdesk by about 70%.
We have complex password requirements, but it also bans any dictionary words so say goodbye to memorable multi word passwords.
There is a company mandated password manager we must use (but you guessed it, it's via a web page)
.. so, lots of fun when the web based password manager is down
.. theres easy workarounds as a coder, you can always find a line of code that hits the requirements so use that as your password & make a note of file, version and line number and it just sits in the drawer amongst your other paper notes of "to do" bits of code to inspect. Been saved by that more than once when password manager was having a wobbly.
The curse of modern civilisation.
Letting them loose on SharePoint administration is especially bizarre - all the native hindrances of shite cloud-shite, combined with an arbitrary and pig-ignorant security paradigm. The only work ever accomplished is by the phishers and data thieves.
I think the main thing that makes people avoid and then give out about these security audits is that it makes them feel and in some cases look.stupid for either getting caught out by what is obvious or being seen forgetting new passwords and having to ask for a reset again. Usually compounded by a general disdain for IT staff even though they keep the place together.
All the research I have seen says the opposite.
In practice the reality is that some people are very highly resistant to training in this way. They just will keep clicking the link, or OK'ing if the authenticator on the phone asks them "is this you?".
Keen to see evidence that it works, that is not sponsored by a mob who provide the service for money.
The Co-Op Bank has a terrible habit of phoning me and asking me to prove my identity by giving them some security information: date of birth / place of birth / two digits from my PIN. Every time they do this I report it to their security team. It simply does not seem to occur to them that with two or three calls ("Oops, dropped") a scammer could get all they need to access my account.
The RBS tried something similar recently and the person on the phone got really quite upset when I asked her to prove her identity.
John Lewis do the same. I tell them that this is arse about face, that they *know* who I am (after all, they called me) but I have no idea who they are, so could *they* please prove their identity.
Same problem with NHS, but now they just send me SMSs..
Barclays app does this quite well. They call me and at the same time send a message to the app. The caller says “I’m mr smith from Barclays”, but everyone could do that. But he also asks me to open the app and it has a notification “Mr. Smith from Barclays is calling” which should be very very hard to fake. Then I click a button saying it’s me and get an SMS. Or something like that. So they know they called the right number, and unless I’m bloody stupid I haven’t sold my phone and left their app on it. _And_ they use a passcode that is different from the phones passcode.
I may or may not have done this at a place of work who was with Google. Shitty Google Workspaces where there was no control over the spam filter, not even as super admin. Oh no, only Google are allowed to touch that. So if e-mails were being falsely flagged there was no option to change this.
So during my last month, I may or may not have flagged every e-mail from certain directors and other "important" people that came into my inbox as spam. Unfortunately never found out if it worked (I doubt it, I'd assume more than one user would have to flag them)
The problem is, most users would, given half the chance, have no password. Forced to have a password with no restrictions, they'll chose something easy to type or remember.. Make it more difficult (such as requiring longer passwords, with numbers and punctuation etc), you run the risk of them writing it on a post it note and sticking it somewhere, or they'll use the same password everywhere.
Even MFA has it's issues. MFA is lovely when it works, but when it doesn't, can be a pain.
All of this can cause user annoyance. As do test phishing excercises.
Don't get me wrong: I think from a security point of view, these exercises are good. I like reading about scams, and like to consider myself naturally sceptical, and difficult to scam. I'm certainly a lot more knowledgable about these things that the average person, and I know I can be scammed.
It's just these things do annoy users.
Some people can only learn by experience. They don't learn from being told even by simulation in a classroom. Others are simply "too important to waste time" learning stuff they don't see as relevant. As for the Uni ebola phishing "test", if you're going to do that, and have the numbers to show it's a worthwhile method, then sending something that puts the fear of $deity into them and induces panic mode is possibly the ideal way to get the message across. Because that's the sort of psychological tricks scammers get up to all the time.
Ugh, fucking IT and their passwords. My company just forced us to swtich to a FIFTEEN character password, random letters, numbers and special characters, with certain combinations not allowed - which you can't figure out what isn't allowed until you try it. New one required every few weeks. Fuck it, anyone who steals my laptop will find my laptop password taped to the keyboard, and there's a notepad labeled "Passwords" with all 60+ apps I'm required to use to do my job, with links, usernames (they aren't all the same) and passwords. They aren't the same either but must follow the same protocol when the equipment allows. Oh, and there's no sort of password manager either - they're not secure enough. We're just expected to remember when I'm the sort that can't remember what my last meal was.
The email content was not real and inappropriate as it caused unnecessary panic, potentially undermining trust in public health messaging," his missive said. "We sincerely apologize for this oversight."
So they are more worried about people's trust in the public health messaging than they are in the universities security.
If they can't simulate messages like this, then I don't see how they will successfully manage to avoid actual phishing emails which are becoming more and more sophisticated.
In our company we are now at the stage where we are doubting even legitimate emails.
What is it with US orgs and poor Phishing awareness schemes.
I received an email from my boss at 3PM offering sarnies for lunch if I clicked on the link.
Said boss was currently dosed up on chemo and probably strong pain killers so wasn't running on Greenwich mean time let alone Eastern Seaboard time.
> we are now at the stage where we are doubting even legitimate emails.
...aaand you're trained. Congratulations, collect your certificate at going-home time. You should doubt all emails initially, and know how to identify the legitimate ones to eliminate reasonable doubt.
"The link is broken, tells me to update my browser. How about you make the page backwardly compatible for older versions of Windoze."
That's part of the selection process. If you can't afford a new computer and the latest version of Windows, you're not worth the effort of scamming :-)
“You should doubt all emails initially, and know how to identify the legitimate ones to eliminate reasonable doubt."
Do you actually believe that I am the one making the decisions and that I have the authority to stop links, or that the management haven't been warned multiple, multiple times .
And why does our company insist on allowing links, , because without them the Sales team can't put those damned logos and shit event scenarios in email signatures .
Think again.
You can pick up your pink slip for not understanding how most companies work.
That's exactly what should be happening..
EMAIL CAN NOT BE TRUSTED. Period.
All the attempts to bolt "security" on a fundamentally insecure protocol just don't work. The ones that are technically sound are too complicated for normal users, who can't figure out the difference between a lock indicator on the URL bar and a lock graphic in the web page.
People have to learn that you can't trust e-mail. If a "genuine health warning" is sent out via e-mail and that's the only way it is sent, then the senders need to learn how to do their job properly.
@Dostoevsky "Email is not the proper channel for public health warnings."
The proper channel is of course a text sent to smartphones https://www.theregister.com/2018/01/15/hawaiian_missile_warning/ or https://www.theregister.com/2023/04/21/florida_emergency_alert/. ;)
Joking aside no one channel is used to inform the public of health warnings, normally through various media/news/press outlets, via TV, radio and web, may even use EWS. Sure there will be an official posting and/or website for a public health warning, but if you expect the public to read that health warning then you have to tell them where it is (a website address).
Now of course Email would not be used for public health warnings. But when it comes to companies issuing an internal health warnings to their employees at site or reginal location emails make sense. They probably have company email addresses groups for site and regions.
I believe that it is an apporpriate channel, but no links should be sent along with it. The current guidance on securely using emails is to verify using a secondary source entirely separate from the recieved email.
It should be something like:
"Public health warning: Green goo disease currently spreading. Please look at the agency website for more details"
It has the added benefit of limiting the survival of anyone not able to find a website with a google search.
We do get it, we get the exact problem they think they have when in fact they already had a problem.
They had already had a genuine phishing email, they told people to never trust email, sent out a fake phishing email, people still trusted the new email as fact and now they're moaning about people might not trust emails as fact.
Now do you get what the core problem is here, it starts with "e" and ends with "l". Email is simply no longer fit for purpose, it's basically useful for sending text informaiton but all the HTML, links, pics and other bollocks they've crowbarred into the specs is now useless as email is still one of the number one initial vectors for scuzzbags to get their claws into your org. No matter how much you beat people with the "DO NOT TRUST EMAIL!" stick they still come back for more punishment by trusting emails and clicking on links, as if there's some sort of prize for how many stupid email links can people click in a day.
The problem is not email. It's not HTML in email. In any functioning organization, there's a need for some kind of communication. Any communication can be faked. People fall for scam phone calls, scam web adverts, scam printed letters on paper, scam SMS messages, scam messages sent over E2E encrypted messaging systems, scam social media posts, and they will fall for scam anything else that can be sent in. Some parts of email could be better, although many of the worst ones have already gotten patches to try to help, not necessarily correctly.
In all of those cases, there are technical measures that will reduce the problem, but no system, no matter how thoroughly designed can use a technical measure to eliminate the problem or the need for receivers of the communication to work with skepticism. Phishing will never go away. Users will have to recognize this fact and learn how to recognize it when it comes in. Even if we eliminate email with all its historical cludges and replace it with something else, and I'm not sure what you think that something else should be, the problem will only reduce in scale, and possibly not even permanently once the scammers adapt to the change.
Who said the goal was to "eliminate" anything?
Security is not an absolute. We seek to increase costs for attackers and/or lower them for defenders. If you start from the position that security ought to be, or aims to be, perfect, you're not making a cogent argument.
Removing links from email messages raises the cost (of a successful attack) for attackers, because it raises the work factor for users to fall for the attack, and that means fewer users will fall for it. Anti-phishing training, if it achieves anything useful at all (and that remains to be shown), ought to have an (almost certainly smaller) effect along the same lines.
The argument was that email is the weakest link due to technical limitations. There are a few technical problems with email that could be improved, but in many cases, they are not necessary and not used for successful phishing attacks. Email is the most often used path into an organization not because it's technically weaker, but because that's the most common way for an external party to communicate with the organization. I can't hop on a company's internal Slack or Teams groups without hacking an account (although an attacker might hack an account so people need to know that phishing can happen there as well), but I can send them email. If email were removed, then most phishing would come through whatever external communication method replaced it.
It is popular to see phishing as a technology problem. IT people like it because we are already used to trying to solve most problems with technology because we can and it doesn't require any of the less reliable methods of trying to solve it. Non-IT people like it because it means they can tell IT to fix it and stop paying attention. It sometimes makes more sense to file it there because sometimes it is attached to things that are actually IT problems such as malware or account compromise. The problem is that it's not really an IT problem any more than scam letters were a post office problem. No matter what technology-based solution you try, the improvement will be marginal. Since nothing else is being done, by all means find any technical hammer and hit that nail. However, if you expect a lot of movement, to not have to train people to be vigilant, or to not have failures, you will never get any of those things.
Except as per the article, it was based on a real Ebola health issue phishing scam from a previous year, so people DO need to learn to tell the difference between a legit one and a fake one. Yes, you might be able to instil awareness with other forms of phishing, but you still need the type that instill fear and/or panic because that is the situation the Phishers are trying for, making you click and enter details without thinking it through.
In our company we are now at the stage where we are doubting even legitimate emails.Excellent. Training has had an effect then.
That's what training should do. You should question email that looks dodgy. Pass it on to your Infosec people (if you have any). Let them reeducate the offenders.
Yes. Increase the pain for people putting links in legitimate email messages. When a former place of employment started including links in messages from the Infosec team, I reported every one of those as a phishing attempt. Alas, that team became redundant before they saw the light, but it was a good attempt.
Not so many years ago at a university in the UK did our first phishing exercise. I can't remember the text but it would have been along the lines of "funding issue with your fees". The following day HR raised complaints at the highest level and were demanding discipline be considered. Time and time again they were telling us that "lying to students is totally unacceptable" and how the damage done will take many many years to repair. No further exercises were ever run.
Ditto, every email I get in the company that has links embedded and from people as sources, not automated systems I know about, I now just forward them to the HR and Infosec bods as possible phishing scams. They get fed up and keep telling me to stop and say most are genuine, but I simply say "That's exactly what a scammers want you to think!".
As the best sci-fi films often say, "They took an innocent man, trained him and turned him into an unthinking killing machine!", well that's what all the infosec training they make us take every 2 months has done to me, now I don't trust anything and no one!
Maybe we send and receive different types of mail. I frequently have things that I want to send. Let's take an example.
I've just found an interesting paper produced by a university. This paper can be found at https://ee.engineering.someuniversity.ac.uk/ce/2018/~efermi/archives/2016/rgaaf-pg15-38.pdf
I want to tell my colleague about this because it has something relevant in it. How should I do it. I could include the URL, but evidently, that makes me bad at communication. So maybe I should give them the last search string I used to find this from a search engine. Except that search string is confusing because I was using it to replace the absent or malfunctioning search box on the university's site, so it has a site: filter and a few words that look like I just picked them out of a bag. Also, I used DuckDuckGo and they're using Google, so their results might be different. So I tell them to go to DDG, enter this search string, select result number 5, and oh right, this PDF was not what result number 5 links to. Result number 5 links to a personal page from graduate student R Feynman who worked on a paper about something else with professor Teller. I'm not interested in that, but fortunately, Feynman mentioned when linking to Teller that Teller also works on the kind of thing I'm interested in, so I click on that link and go to a page that Teller wrote. Only there do I find the link to a different paper that Teller wrote with Professor Fermi, which is why the PDF is under Professor Fermi who I hadn't heard about before. So maybe giving a search term isn't the best option.
So instead of that, maybe I should take the link I have and see if I can find a path back to the university's home page. If I'm lucky, I may be able to tell my colleague to navigate to the home page of Some University, and if they don't know that they can always google it, then find the link to the engineering departments, then the twenty more links needed to arrive at this professor's page. So that is not much better and there's a decent chance they'll take a wrong turning and end up at the wrong URL entirely.
If I have somewhere that I want someone else to go, a URL is the way to ensure they arrive there and not somewhere else. This is why, when I tell people to download something, I always make sure to give as clear a URL as possible and never give them a search string. Frequently, when I have used other methods, bad things happen. For example, they Googled something, clicked on an ad that I didn't see because I block them, and ended up in some sketchy site that's more than happy to provide them software downloads, just not the software download I told them to use.
"If I have somewhere that I want someone else to go, a URL is the way to ensure they arrive there and not somewhere else."
Yes, something you can do without making it a directly clickable link with text hiding the actual URL. Most email clients will allow you to right-click a plain text URL and open it. That way you effectively get a clickable link which isn't obfuscated. (Assuming the site itself has a reasonably clear URL and isn't a mish-mash of seemingly random character strings)
A few years ago, my employer sent out a fake termination e-mail. "please click on this link, download the forms, fill them out, sign them and take them to HR", something along those lines. I thought it was a brilliant test.
However, I had a new coworker -- very Inexperienced, but smart and trainable and hard-working. i.e., the dream young employee. However, while her experience was measured in months, the rest of us in the team measured our experience in decades. So...not too surprisingly, she had confidence problems. She got the fake termination phish test, and she told us she freaked out. And I fully sympathize.
BUT...you can't take tools off the table. If we say, "We won't train with 'shocking' content", there's how you get get your phish through. Shock them, horrify them, get them to drop their guard...and a-clicking they will go.
Security training needs to be brutal. Two-up bosses telling underlings to do things (and obviously, managers have to learn to accept people questioning their questionable demands). Disease alerts. Termination notifications. Meet the new coworker. Department after-work party. And drop the stupid "misspellings and bad grammar should be your tip-off" b***s***, because if the target is worth the effort, they'll find someone who can write good $LOCALLANGUAGE.
There is a limit to what's acceptable, still. How about sending fake phishes to Ukrainians about their sons dying in the war? Fake phishes to Israelis about their hostage family members being found? Fake phishes to Palestinians abroad about their Gazan child relatives being killed, to confirm identity? Fake phishes to American parents about their child being injured by a school shooter, or committing suicide?
There's a point where people don't think the phishing test is that important in the grand scheme of things, and will want to destroy you for toying with their emotions. Is realism in phishing tests really more important than everything else in the world? Probably not.
I agree with you that there's always a limit somewhere where the temporary negative emotion you cause someone is severe enough that it's not worth doing the test on that topic. However, there are people who put that limit quite low, and I think that can be a problem, because attackers do not think the same way. If someone wants to really phish you and find that informing you of a child's death is the way to get your attention, they will do it. In fact, there have been a few people who think that "child's death" is not severe enough and use, as their phish bait, faked recording of your child being tortured live for your convenience. Just because phishers do that doesn't mean the tests should. Something that is shocking but less so should still be on the table because, if someone is going to try it, then people should be aware about it.
Where that limit is depends on a lot of variables, but I am not convinced by the people who basically think that, if people felt the least bit nervous about the content of the email, it was automatically immoral to have sent it. The same is true of communication promising a reward which annoys people when the reward turns out not to exist. Sorry, but that's one of the phisher's most common lures and has been since the time of horse-based paper-scam delivery.
The problem is...you mentioned REAL WORLD scams that actually take place.
Which would you prefer: "your son's been killed" and turn out to be a phishing training drill, or "your son's been killed" AND they just used your emotions to penetrate your company's security systems, or your bank account, or... ?
People need to learn, think first, emotions later. They ARE out to get you. The bad guys don't give a rat's ass about your "feelings".
True, but see Doublelayers post above yours. You don't train soldiers by shooting them (You might use "live fire" exercises when they ARE trained, even near the end of training, but not on day 1 and you still take every precaution to NOT demonstrate actual fatalities or injuries)
"BUT...you can't take tools off the table. If we say, "We won't train with 'shocking' content", there's how you get get your phish through. Shock them, horrify them, get them to drop their guard...and a-clicking they will go."
Perhaps you would not need train them to keep their guard up with "shocking' content" if you trained them out of the habit of clicking links. In my experience receiving a phishing email happens rarely, while internal company emails containing links were very common, probably a daily occurrence. So you regularly clinking links but keeping your guard up to spot that rare phishing email.
If we were trained not to include links in emails, then on the rare occasion we received an email containing links it's unlikely we would click a link even if it was "shocking' content".
But no matter how well trained we are no one is perfect mistakes can happen. All it takes is a momentary lack of concentration for a link to be clicked. So why not remove even that possibility and remove or disable all links from from incoming emails.
Because links are very frequently necessary. You can forbid them, no problem, but all that gets you is people pasting URLs into the email. People who are used to clicking links will now copy and paste them, and they still need to be trained to look skeptically at them first or a scammer can just send their phishing message with a URL in plain text.
Of course, there are lots of emails that could stop having links in them, like my financial institutions that always tell me how to find the information that's too private to include in the email by logging in manually, but not before giving me a link to the same information that could go anywhere. I would really like it if they stopped using links. They're not going to, though, so people need to learn what to do when we can't impose our good ideas on every business we deal with.
Oh yeah.
Same job they sent the fake termination notices out, they used an "secure e-mail" system that basically sent you a link to click on to get your e-mail off a website.
So not at all infrequently, we'd get unexpected e-mails from people we'd never heard of about things we we didn't know about with a link to click on. And the same management that enforced "security and compliance training" expected us to violate exactly the guidelines they "trained" us on. I refused. I ain't clicking on that thing. (security team hated that service for that reason. Well, that, and a certain jackass (me) kept hitting "report phish". Don't know what bothered them more -- me hitting "Report Phish" or the fact that so few other people did.
... if the target is worth the effort, they'll find someone who can write good $LOCALLANGUAGE.
I wish my old company had done that; some of the 'official' missives were appalling.
#like for all those pointing out that company missives should not be training people to click on links by insisting on them in company emails - particularly when those links are to 3rd party sites (such as the outsourced HR, an independent survey company, or similar). Very frustrating when they could have just given a written instruction to get the details from the company's intranet site.
However, I had a new coworker -- very Inexperienced, but smart and trainable and hard-working. i.e., the dream young employee. However, while her experience was measured in months, the rest of us in the team measured our experience in decades. So...not too surprisingly, she had confidence problems. She got the fake termination phish test, and she told us she freaked out. And I fully sympathize.
As a young newbie at a company, I might have just been overwhelmed and just headed for home. A really fragile and desperate person might contemplate self-harm, especially if the job were all they had standing between them and destitution. I don't know what a proper phishing scheme should be, but this isn't it.
The solution to this: Another fishing mail where you report that a young impressionable employee killed herself after receiving the fake termination notice.
Two links to click on: “I feel so sorry to hear this” and “serves her right, stupid cow”. Click the first, terminated. Click the second, terminated with prejudice.
California, being a very large state, has a bunch of public (government-funded) universities and they're all named University of California [city name]. Their relative quality can be debated, but it is part of the same system as some of the more famous ones such as University of California Berkeley (of BSD fame) and University of California Los Angeles. Each one has its own leadership but there's a central organization that coordinates things between them. I don't know much more than that about how the system works.
I'm told that when colleagues perform poorly at simulated phishing attacks sent via email they are subjected to further simulations until they shape up. Some staff complain that they get so many emails and that they're busy. We're all busy and some of us bother to concentrate or actually get in a few minutes earlier each day and have a bit of extra quiet time to attend to any email backlog.
What the moaners fail to appreciate is that they are more than likely being subjected to similar attacks via SMS, telephone calls and emails in their personal life and that if they learn to be a bit more savvy at work it might actually save them quite a few quid and an awful lot of nightmares. Their employer might survive too.
Coat required because autumn's come early in South West England . . .
Currently in a position where my own workload is unmanageably high. But overall that’s my manager’s problem, and what I don’t have time to do in a day will have to wait.
While I don’t believe the necessary time should be found from one’s own time, I agree with the general point that the user needs to take reasonable responsibility for managing their time and doing things properly.
The point really is if you fall for a fake phish you could fall for a real phish. Regardless of workload it’s essential to pay attention. Security is a higher priority than most other concerns, after all, if you muck it up you’ll have a lot more on your plate to deal with.
What a pathetic fucking attitude this is. "Oh, every minute of my day must fall in the 'work' or 'personal' category, and I will fret over any miscalculation!"
Personally, I haven't been paid by the hour since I was an undergraduate, and I don't worry about how many minutes I spend working for my employer, versus working on the many projects of my own, or time spent with family and friends, or solo leisure. I do what I want, and I am well-compensated for my output on behalf of my employer.
I guess that depends a lot on who you work for and especially if being paid by the hour or not. If you are effectively paid "piece work", then yeah, it's doesn't matter how long you choose to spend on the job so long as the job get's done. Those paid hourly and working for a shitty boss, yeah, clock off on time and don't give the bastards anything more than they deserve :-)
Personally, I'm hourly paid, but I also like to do a good job and not leave shit for others to clear up and I'll only put overtime claims in if it's over half an hour or so usually (relatively rare anyway). But then my boss is good and there's no issue of leaving a bit early if everything's done for the day or for other, personal reasons.
Sigh.
I.T. is not magic, it is a learned skill. A situation very analogous to driving a car and the requirements around that.
The situation by Mr or Ms A. Coward is EXACTLY why there should be a licence or certificate to demonstrate basic IT competency in the workplace. If such a beast existed and had wide acceptance, I know that I would make some of our users sit the exam and/or produce the certificate. For the reason of demonstrating to their manager the users' competency (or more exactly, the lack thereof).
There was previously a ECDLC thingy, but that has died out and wasn't well known in the first place.
the closer to the real thing the better, do you think perps think about feelings, 'oh we better not do that, it's cruel!' get a grip ffs. Best medicine is, think like a perp, act like a perp and fish out the weakest link for thorough training, or your business might end up dead in the fishy water! You need everyone to spot the disease ridden trout! Oops, No harm intended mentally to trouts, especially ones with a pout. No wonder this world of techbola is fukd. Feelings?!!feelings!!?!! fvk feelings, keep the money rolling in. Rant over!
Make people proud to be able to spot Phishing emails, don't just scare them.
Training means you have to do some---training. And yes, that might need some time and investment.
Say-- a "How to spot a Phishing message" session, with a small reward for correct answers ( a sweety or a voucher for a coffee).
Maybe like the Scam Aware courses a chance to earn a little "Phishing Awareness Ambassador" certificate with the role of guiding others.
Empowering people works better than (just) terrifying them. Carrot works better than stick.
What nonsense !!! I read through almost all the comments on this article and in my opinion most missed the underlying issue. Criminals don't care if they "cause unnecessary panic, potentially undermining trust in public health messaging". We in the Information Security world get paid to think like criminals, ponder the absolute worst case scenarios, mingle with those who have absolutely no morals, conscience nor soul. Modern media has done a huge dis-service to the general public portraying "hackers" as a bunch of fat, pimply faced nerds living in their moms basement looking for on-line places to hide their porn collections. OR personable anti-hero types a-la-a Mr. Robot. Organized crime does not care if the money comes from an orphanage or from Satin himself as long as the money keeps flowing. Somehow we have to convey the seriousness of our adversaries to the general public. I have tried the softer easier way, no none listens. I say go to the whip. The Russian FSB and the US Navy Seals have an acceptable loss (death) rate in training and while that's awful the point is that they recognize that if you want extraordinary things you have to be willing to go to extreme measures. I feel bad for the CISO who undoubtedly was told to issue and apology or loose your job immediately instead of having 90 days to look for a new job. Live in the real world, not the world you wish it was. ---MuleD
I used to think that phishing simulations were worthwhile. Indeed, they were used in one place i worked.
I've since learnt they serve no useful purpose.
Some people cannot be trained by sending them an occasional phish, to stop clicking those links. Training simply does not work this way.
The evidence suggests there is a sub-section who are highly resistant to learning about clicking on phishing emails.
Rather than waste everyone's time, better to build a working defence against these incoming emails in the first place.
Think "Defence in depth".
A bit like vaccines. There might be 20% (estimated number, pulled out of posterior) that CAN be trained. They either learn from the email or directly, or they are identified by falling for the phake phish and given a few pointers. For these, the simulations are worthwhile and the carrots are good. (A vaccine in this instance would have changed a severe case to a mild case).
There are another 20% who are immune to education. They are also identified by falling for the phish. Carrot does not work, but perhaps stick will. Eg, extra, extra training, time in the naughty corner or eventually losing the job due. (Observation, this 20% who are immune to education are also extremely upset at even the slightest change to the routine, they have simply put their brain on the shelf at the end of their formal education and are determined to never use it again).
Then the other 60% just need the best pointers for some of the key signs that the sender may not be who they say they are. Eg, "External Email", "Action warning" and blocking EXE, AV scan for corrupt documents, etc.
And of course, anyone can have a bad day, not enough coffee, awake all night with the kid(s), etc and click one time on a dodgy link.
Nonsense.
These tests are just due to low IQ security people being hired. They don't actually know anything so they invent crap like this (and insanely boring training courses).
For example, our org replaces all HTML email "external links" with links that look like they are internal but redirect to external links. Just to make it even harder to figure out if an email is an attack or an actual internal email.
They also have a big flashing "this came from an external email" banner... then have genuinely internal mailing lists that trigger it.
So, yeah - training should start with the security group.
"Rather than waste everyone's time, better to build a working defence against these incoming emails in the first place."
People have been trying to do that since the 1990s if not before. If you can find a better way than all the alternatives, you can probably sell it to a lot of people. The problem is that, just like all the others, your solution will either pass through some phishing or dump some important emails in a location where nobody can find them, probably both. This is why people are trained to know that it might come in and tested to make sure they're aware about what to do.
Your suggestion is yet another item in the familiar category of requesting that a computer make it impossible to do something undesired. From the earliest computers, people have been asking for them to eliminate human error. Some types of human error can be limited, but none can be eliminated and some types can't be reduced much at all. By all means keep trying, but I'm going to continue having plans for if you don't achieve 100% success.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
