Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Should Failing Phish Tests Be a Fireable Offense?

krebsonsecurity.com

Post reply on HN
Print view View original

111–120 of 357 posts

Re: Should Failing Phish Tests Be a Fireable Offense?

#111

Post by carlmr »

LaGrange wrote: post #84
Consultant32452 wrote: post #40

Earlier quoted context omitted.

I work at a financial company and we have a similar policy around phishing email. Embarrassingly, I failed this once and then created an email rule which filters out the fake Phish. No idea if it gets real Phish.

...and now we see why such policies are bad, and it's even covered in the article: while people falling for phishing are bad, what's even worse is when they fall for it and don't report. Creating a culture where the security is the enemy is _not_ good. I mean, sure, if it's 20 times, we're getting into outrageous territory and you have reasons to suspect employee is trolling you. But other than that, the reality is t…

I also incidentally found an easy a filter for these. I found once that our proxy auto config has 10 misspelled domain names. Those are all used for the Phishing Tests.

Re: Should Failing Phish Tests Be a Fireable Offense?

#112

Post by noir_lord »

inetknght wrote: post #64
samfriedman wrote: post #51

Earlier quoted context omitted.

I recently failed a suspicious email / phishing test for the first time, and I am also one of those people who never thought it would happen to me... The email was a newsletter I didn't care about, and the unsubscribe link was (fake) malicious. That one impressed me because it preyed on what is now a pure reflex to click the unsubscribe link.

> a pure reflex to click the unsubscribe link. That's a learned trait. I don't click unsubscribe links; I click "report spam" and "report phishing" button. If only Gmail would let me create filters to automatically mark entire domains as spam though. That would be nice...

One of the reasons you'll pry Evolution from my cold dead hands is Right Click -> Create Filter -> @domain.co.uk and done.

I have filters for almost everything, my boss goes into one folder and gets set one color, automated notifications from my internal system another (green if everything is OK, orange if there is something I really need to look at).

What I really* want is a desktop client that exposes a nice clean Python (or similar) API so I can automate even further - I mean Python has everything I want if I want to do that from the CLI/cron but having it built in would be really nice.

Re: Should Failing Phish Tests Be a Fireable Offense?

#113

Post by barbecue_sauce »

wil421 wrote: post #101
dsfyu404ed wrote: post #17

I worked for a defense contractor that had a 3 strikes policy for security violations. Failing the phishing emails was a strike. Other breaches of security policy (like getting caught letting someone tailgate you in) could be strikes too. You got fired at 3. Nobody thought this was unreasonable. Part of your job when you work in defense or finance is giving a sufficient number of fucks about things that people in oth…

I had to take a security training class because I failed to report a phishing attempt. Didn’t click the link and likely ignored the email altogether. My boss was confused why they contacted him. I don’t work there anymore.

Would it have counted as failure if you simply had never opened the e-mail?

Re: Should Failing Phish Tests Be a Fireable Offense?

#114

Post by BeetleB »

onion2k wrote: post #79
jsty wrote: post #68

Earlier quoted context omitted.

Considering that from what I recall Lynx doesn't execute javascript, it would have to be one esoteric zero-day

Downloading and executing code is only one way a browser session can be abused. At the very least you're giving away everything your browser (even Lynx) puts in the headers of a request. That's often a heck of a lot of useful information for an attacker. Lynx supports cookies too so it would be possible to track a user between sessions. I don't know how that might benefit an attacker but I'm not an attacker[1]. I thi…

>At the very least you're giving away everything your browser (even Lynx) puts in the headers of a request.

Which you're giving away any time you browse any external web site.

>Lynx supports cookies too so it would be possible to track a user between sessions.

You're downloading cookies for most external web sites.

If the worst you do is the same as going to espn.com, then reprimand people for going to any external web site.

Re: Should Failing Phish Tests Be a Fireable Offense?

#115

Post by [deleted] »

Consultant32452 wrote: post #49
thrwwwy29may wrote: post #46

Earlier quoted context omitted.

> Embarrassingly, I failed this once and then created an email rule which filters out the fake Phish. how did it get you, if you don't mind sharing? It seems if someone who works in IT (guessing you do) and is very careful fails it, this is an impossibly high standard to meet. curious how they got you.

That's just it, I simply wasn't being careful. Everyone gets distracted sometimes. I don't remember it in detail, but it was a fairly standard phishing email from a fake domain and I clicked a link. Not only am I in IT, my department is somewhat security related.

[deleted]

Re: Should Failing Phish Tests Be a Fireable Offense?

#116

Post by maxk42 »

ryanjshaw wrote: post #47
maxk42 wrote: post #25

I'm a tech professional and security is a regular part of my jobs. At one point -- while contracting for a Fortune 500 client that shall remain unnamed -- I received an email that was quite clearly phishing. Curious as to what the payload was and whether it was worth reporting, I fired up lynx and followed the link in the email from the command line. I was promptly informed that I had failed the test and I would be r…

Can't speak to whether a reprimand is warranted or not and I think many here will disagree, but unless your job is investigating phishing, you shouldn't do this because you ARE ultimately putting the corporate network at risk unnecessarily - what if it was a real link and happened to exploit a zero day on your box? Management wouldn't accept your reasoning for following the link I suspect.

My job is not investigating phishing but security is everyone's job. Reporting what was obviously a targeted phishing attack to the people who do investigate phishing is a basic expectation. Now before you try to tell me "well you should've forwarded the email and been done with it" those guys are going to be pissed as fuck if I pass along every spam link trying to sell me boner pills, so I've got a duty to make sure it's a credible threat. As somebody who knows how to safely investigate such a link and did exactly that it was ridiculous to be penalized. Security (albeit not for email) is a part of my job. I don't think people should be trained not to use their brains when it comes to security threats. If people used their brains more often phishing would hardly be a problem to begin with.

Re: Should Failing Phish Tests Be a Fireable Offense?

#117

Post by barbecue_sauce »

grimjack00 wrote: post #77
Sohcahtoa82 wrote: post #31

Earlier quoted context omitted.

Did you alter the URL at all? Every phishing test campaign I've seen has a URL in the form of like http://totallylegit.your-company.com/somePath/login?id=12345... . I'd change the id= to some other value before testing to mess with their tracking.

Unless you're certain how that ID is generated and/or linked to your identity, you've probably just put someone else at your company on the naughty list.

"We just got a new alert that an employee fell for the phishing attempt!"

"But... this employee has been dead for 20 years..."

Re: Should Failing Phish Tests Be a Fireable Offense?

#118

Post by istandintraffic »

We definitely do not enforce tailgating enough at DoD. I find it best to stand aside at let people pass before I swipe. The funny thing is that they have security that ensures there is ample space between us, but still some jackhole wants to bend the rules because they are special.
Post reply on HN