As an employee education campaign, my last Bigco employer started sending out their OWN phishing emails, and if you clicked a link in one of them, you'd be taken to a page explaining how you got tricked and what not to do. Pretty good way of targeting the message to those who need it most.
Should Failing Phish Tests Be a Fireable Offense?
71–80 of 357 posts
Re: Should Failing Phish Tests Be a Fireable Offense?
#72Earlier quoted context omitted.
There's was the general "don't follow links in unknown emails" but nothing about what to do if you're sure it's a bad email but terminally curious. As far as I could tell nothing bad could happen (even JS was off in the browser I used to open it) when I followed the link, but is there something I should be aware of?
Worry about CSS-based exfil. https://www.mike-gualtieri.com/posts/stealing-data-with-css-... The security teams are correct in the training they run about these: report the suspicious email and leave the investigation to them, don't try to DIY the investigation. Note you aren't penalized for false positives (reporting a legitimate email as a phishing attempt).
That is a nifty way to steal data. Luckily I was running in a completely clean environment inside a VM so wouldn't be an attack that could have occurred this time.
Re: Should Failing Phish Tests Be a Fireable Offense?
#73How hard is it to make people understand what a business email should or shouldn't include? If you're being asked for data by someone you don't know, either ask a manager or someone connected to the account in question. Are people really so gullible & trusting?
Have you ever worked for a big company? (Think several US offices, half a dozen European and Asian offices, 500m in revenue).
Someone forwards me an e-mail from our Dutch office that says, essentially, "The world is burning down, we are boarding a plane in a couple of hours to go to IFA (show), and we don't have the latest copy of product X to demo for customers."
I do builds by hand of this product because I can't get resources allocated to automate it
I have never heard of any of these people before. I reply asking, "I am sure I can accommodate you, but, Who are you and why I haven't been told about this before now?"
To my shock, the guy replies, "I'm the European Vice President for product X, we didn't ask before now because it has never been a problem in the past. Who are you?"
I reply, "I'm the only person in the entire world with the encryption keys to provision the product, and that has to be done on one single computer in Santa Ana. It's only a fluke that I am here today-- my car wouldn't start this morning, and I had planned to take the day off to fix it, and then by some miracle an hour later it started. That's why it's important to know about things ahead of time."
That's what working at a big organization is like, you interact with people who don't know all the time. And frankly, nobody is ever allocated time for "security" in their schedule. My dance card at that company was scheduled for 8 hours of development a day, no e-mail answering, no security, no time to do the build system. No time for meetings. Nothing.
Re: Should Failing Phish Tests Be a Fireable Offense?
#74I see this a lot as a security guy. There has to be a healthy medium. Users can be fired, sure, but this should be a last resort. It's not really fair to say "you're fired" when you don't have DKIM/SPF/DMARC, you haven't tagged external emails as such, you haven't provided here awareness training, you have provided training but not in a gradual form (ie. From Nigerian prince emails right the way through to sophisticated attacks), you're not providing outbound filtering, educational resources or a reporting tool, you've not registered similar domain names or . otherTLD, sandboxing, AV...
Users know what phishing is, even the most naive of them. You need to do your darndest to make sure nothing gets in to your network first off. If people are repeat offenders then you have to chat with them first off and figure out what's going on . If they're being intentionally obtuse - clicking emails to see what happens even if they know it is phishing - then look into firing them, otherwise just act like you're on the same team, provide them with education but not overwhelming amounts, and it s eems to work has been my experience anyway
Re: Should Failing Phish Tests Be a Fireable Offense?
#75Earlier quoted context omitted.
When a new phishing test goes out everyone in my department announces to everyone else to watch out for it. So it's a bonding experience of the non-security people against the security people.
That seems okay though, since it's also behavior you'd want if real phishing emails were coming in.
No. Because the department that has advance warning of internal tests will be unlikely to be the first targeted by real phishing emails.
Re: Should Failing Phish Tests Be a Fireable Offense?
#76Honest question: why do so many workplace penalties come with only two levels of punishment?: words ("reprimand") and getting fired. This would be like only having speeding tickets and the death penalty in normal law. Losing part of your bonus for the year would certainly sting enough to provide a disincentive without having to fire anyone.
Many people don't get a bonus. If you have no benefits, an hourly wage, and no path for advancement, the only thing they can do is whine or fire you.
Sure, that's an explanation for those sorts of jobs, but they aren't usually a target of phishing attempts.
Re: Should Failing Phish Tests Be a Fireable Offense?
#77I'm a tech professional and security is a regular part of my jobs. At one point -- while contracting for a Fortune 500 client that shall remain unnamed -- I received an email that was quite clearly phishing. Curious as to what the payload was and whether it was worth reporting, I fired up lynx and followed the link in the email from the command line. I was promptly informed that I had failed the test and I would be r…
Did you alter the URL at all? Every phishing test campaign I've seen has a URL in the form of like http://totallylegit.your-company.com/somePath/login?id=12345... . I'd change the id= to some other value before testing to mess with their tracking.
Unless you're certain how that ID is generated and/or linked to your identity, you've probably just put someone else at your company on the naughty list.
Re: Should Failing Phish Tests Be a Fireable Offense?
#78OK, if you do that, I won't open any links in any emails from itdepartment@example.com, where itdepartment@example.com is the group email of my company's IT department.
I may or may not open any emails from that address period, depending on how paranoid I'm feeling.
Or... and catch me if I'm talking crazy here... or do you want to fix the email software so I can trust that only the IT department can send me emails from itdepartment@example.com which actually make it through the firewall and email filtering software and internal email security policy to reach my email account?
Re: Should Failing Phish Tests Be a Fireable Offense?
#79Earlier quoted context omitted.
Can't speak to whether a reprimand is warranted or not and I think many here will disagree, but unless your job is investigating phishing, you shouldn't do this because you ARE ultimately putting the corporate network at risk unnecessarily - what if it was a real link and happened to exploit a zero day on your box? Management wouldn't accept your reasoning for following the link I suspect.
Considering that from what I recall Lynx doesn't execute javascript, it would have to be one esoteric zero-day
Downloading and executing code is only one way a browser session can be abused. At the very least you're giving away everything your browser (even Lynx) puts in the headers of a request. That's often a heck of a lot of useful information for an attacker. Lynx supports cookies too so it would be possible to track a user between sessions. I don't know how that might benefit an attacker but I'm not an attacker[1].
I think a reasonably paranoid approach like "Hackers might think of ways to abuse this that I haven't thought of" is best. Unless your job is to take a risk and visit a phishing site, don't take the risk. Even with Lynx.
[1] Exactly what an attacker would say!
Re: Should Failing Phish Tests Be a Fireable Offense?
#80Earlier quoted context omitted.
> I never think twice about clicking links. I hope you don't work for any sensitive position.
That's not very fair. Browser exploits are a lot rarer than phishing.
I don't think background noise of broad, low-effort phishing emails can be directly compared to a more focused attack. If you work somewhere with interesting data the odds of a good phishing attack leading to an exploit could be much higher because you're being specifically targeted and they're not going to send the message until they have a current exploit ready (probably hoping to get it in before your IT department's change window, too).