Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Should Failing Phish Tests Be a Fireable Offense?

krebsonsecurity.com

Post reply on HN
Print view View original

311–320 of 357 posts

Re: Should Failing Phish Tests Be a Fireable Offense?

#311

Post by JamesBarney »

dsfyu404ed wrote: post #17

I worked for a defense contractor that had a 3 strikes policy for security violations. Failing the phishing emails was a strike. Other breaches of security policy (like getting caught letting someone tailgate you in) could be strikes too. You got fired at 3. Nobody thought this was unreasonable. Part of your job when you work in defense or finance is giving a sufficient number of fucks about things that people in oth…

I like the three strikes rule. Sometimes it just slips through.

I got caught by a phishing link once because I had just gotten off the phone with a co-worker John and got an email 5 minutes later that said "hey James, it's John". Didn't even think twice about clicking it.

Re: Should Failing Phish Tests Be a Fireable Offense?

#312

Post by overgard »

megaremote wrote: post #300
maxk42 wrote: post #25

I'm a tech professional and security is a regular part of my jobs. At one point -- while contracting for a Fortune 500 client that shall remain unnamed -- I received an email that was quite clearly phishing. Curious as to what the payload was and whether it was worth reporting, I fired up lynx and followed the link in the email from the command line. I was promptly informed that I had failed the test and I would be r…

Yes, it does. You should have been let go.

Really, you'd fire every engineer that shows an ounce of curiosity? I'm glad I don't work where you work.

Re: Should Failing Phish Tests Be a Fireable Offense?

#313

Post by overgard »

dboat wrote: post #37
maxk42 wrote: post #25

I'm a tech professional and security is a regular part of my jobs. At one point -- while contracting for a Fortune 500 client that shall remain unnamed -- I received an email that was quite clearly phishing. Curious as to what the payload was and whether it was worth reporting, I fired up lynx and followed the link in the email from the command line. I was promptly informed that I had failed the test and I would be r…

Presumably you were able to explain your case and have the reprimand expunged from your record. As long as they are reasonable in that way I don't think occasionally testing the people handling sensitive data is a bad idea.

I think a better idea for the person involved is to work at a company that isn't run by self-serious bureaucrats.

Re: Should Failing Phish Tests Be a Fireable Offense?

#314

Post by Kalium »

overgard wrote: post #310
Kalium wrote: post #193

Earlier quoted context omitted.

> b) Does the phishing test service detect if the link is accessed via a sandboxed env? In any company likely to be doing phishing testing internally, there are two kinds of people who might try this. One is the infosec group, which isn't going to do this because they're running the test. The other is engineers who think they're clever and are equipped to fsck around with things. The former are professionals. The lat…

Good lord, you make it sound like dealing with highly radioactive plutonium. This is a site called hacker news , if you're a web developer and you can't figure out how to pull an html page without executing the scripts involved (a TRIVIAL thing to do) you shouldn't have a job. And honestly if your network is so insecure that someone running a wget on a domain poses a risk then your network has almost assuredly alread…

> Good lord, you make it sound like dealing with highly radioactive plutonium.

That sounds about right. Your average developer dealing with malware is roughly as safe and sane as playing pool with 6-kilo balls of pu-239. Especially since a lot of places, developers are trusted with things like access to production from their workstations.

> This is a site called hacker news, if you're a web developer and you can't figure out how to pull an html page without executing the scripts involved (a TRIVIAL thing to do) you shouldn't have a job.

You know what's interesting? Even if you can do that, you've already made a mistake and leaked information. You've demonstrated for an attacker deliverability, who is curious and amateurish enough to think they can handle it (but hasn't thought it through), and some useful information about how they believe they are protecting themselves. Fetching a malicious server's HTML safely isn't as easy as might be readily supposed - both curl and wget (https://www.cvedetails.com/vulnerability-list/vendor_id-72/p...) have suffered remote exploits in the past. Those are almost certainly the tools a random dev would reach for and they cannot be assumed to be safe. The odds that said random dev is equipped to set up a sandbox to do so reasonably safely are not great, and the odds of them doing so much smaller.

Curiosity isn't a bad thing. It's a wonderful and powerful trait that has driven humanity relentlessly forward through the ages. Unfortunately, it can also be used against people. Being curious when playing with fire can be dangerous. Especially if you just think the fire is pretty and haven't figured out that it burns yet.

This site may be called hacker news, but it's not full of the kind of hacker that congregates at DEFCON and understands the House of Prime. It's full of the other kind.

Re: Should Failing Phish Tests Be a Fireable Offense?

#315

Post by Kalium »

baroffoos wrote: post #299
ce4 wrote: post #56

Earlier quoted context omitted.

It should be appealable. I see at least two problems with such a phishing test: a) Some test phishing urls include the plaintext mail address of the employee. Easy to retaliate against someone you don't like. b) Does the phishing test service detect if the link is accessed via a sandboxed env?

The env it was accessed in shouldn't matter too much. Simply clicking on a link is a fairly small risk. Not zero risk but unlikely to be an issue. The real issue is when the link you clicked on asks you for a password and you type it in. You should only fail the test for giving a password.

Clicking a link shows an attacker several things:

  * That their attack was delivered successfully to inboxes.
  * What email addresses are live.
  * Who is curious enough that they will investigate.
  * Who believes they understand and can handle the risks.
These are not small things for an attacker to learn. Further, in a world where drive-by browser attacks are real, it's worth thinking very carefully if clicking a link in a phishing email should be regarded as essentially harmless.

Re: Should Failing Phish Tests Be a Fireable Offense?

#316

Post by overgard »

Kalium wrote: post #314
overgard wrote: post #310

Earlier quoted context omitted.

Good lord, you make it sound like dealing with highly radioactive plutonium. This is a site called hacker news , if you're a web developer and you can't figure out how to pull an html page without executing the scripts involved (a TRIVIAL thing to do) you shouldn't have a job. And honestly if your network is so insecure that someone running a wget on a domain poses a risk then your network has almost assuredly alread…

> Good lord, you make it sound like dealing with highly radioactive plutonium. That sounds about right. Your average developer dealing with malware is roughly as safe and sane as playing pool with 6-kilo balls of pu-239. Especially since a lot of places, developers are trusted with things like access to production from their workstations. > This is a site called hacker news, if you're a web developer and you can't fi…

Deliverability is pretty trivial to prove, and if they knew enough to get something in your inbox they probably already knew enough to be confident of that anyway. With regard to wget: 15 vulnerability’s in the last 20 years for such a highly used peace of software doesn’t scare me that much, and I can easily run it from a sandboxed container or vm since I’m using those all the time anyway. And if I don’t want to confirm deliverability, since I’m a web developer and I have a brain, I realise they probably included a unique token to know I’m the one that clicked the link, so I’ll leave that token off the request.

Look the problem with this kind of attitude is people take security less seriously when security experts go overboard. It’s classic boy who cried wolf. If you want people to take security seriously it starts with honest conversations where you treat people like adults and don’t immediately go to hyperbole.

Re: Should Failing Phish Tests Be a Fireable Offense?

#317

Post by Kalium »

overgard wrote: post #316
Kalium wrote: post #314

Earlier quoted context omitted.

> Good lord, you make it sound like dealing with highly radioactive plutonium. That sounds about right. Your average developer dealing with malware is roughly as safe and sane as playing pool with 6-kilo balls of pu-239. Especially since a lot of places, developers are trusted with things like access to production from their workstations. > This is a site called hacker news, if you're a web developer and you can't fi…

Deliverability is pretty trivial to prove, and if they knew enough to get something in your inbox they probably already knew enough to be confident of that anyway. With regard to wget: 15 vulnerability’s in the last 20 years for such a highly used peace of software doesn’t scare me that much, and I can easily run it from a sandboxed container or vm since I’m using those all the time anyway. And if I don’t want to con…

OK. How should we - I - go about this differently?

Adults are perfectly capable of believing that their expertise extends further than it actually does and taking risks they do not fully understand or appreciate. I see it daily in the developers I work with. I have worked with more than one developer brimming with confidence in their ability to tackle areas beyond their expertise, who will try to engineer on-the-fly around any shortcomings pointed out in their approach (this is unrealistic, in real attacks adversaries don't give you friendly feedback iteratively).

I'm plenty willing to listen and take on board feedback here. What attitude should I take? How do I convince responsible adults, in a constructive and serious way, that they are not equipped to entertain their curiosity in this arena and should not try? How should I communicate to you, and to hundreds of developers at once, this message without going overboard or crying wolf?

It's one thing to play with malware and phishing at home, on your own hardware, on your own network, and with your own data. That's all your own risk to assume as you like. It's quite another to do so with company hardware, network, and data. That's not your risk to run and not your risk decisions to make. If you can advise me on how to communicate this to engineers who honestly and earnestly believe in their ability to safely handle things well beyond their expertise, I am absolutely all ears.

Re: Should Failing Phish Tests Be a Fireable Offense?

#318

Post by dearrifling »

Kalium wrote: post #195
dearrifling wrote: post #91

Earlier quoted context omitted.

Counting opening a mail as failing is ridiculous. A a phising test should only count captured logins.

Following a link can readily enough expose someone to risks. Phishing isn't always just about entering logins.

That's true for any email, not just phising. Unless you can verify and trust all senders.

Re: Should Failing Phish Tests Be a Fireable Offense?

#319

Post by King-Aaron »

mason55 wrote: post #58
dsfyu404ed wrote: post #17

I worked for a defense contractor that had a 3 strikes policy for security violations. Failing the phishing emails was a strike. Other breaches of security policy (like getting caught letting someone tailgate you in) could be strikes too. You got fired at 3. Nobody thought this was unreasonable. Part of your job when you work in defense or finance is giving a sufficient number of fucks about things that people in oth…

I actually like the idea of having consequences for allowing tailgating, assuming the company cares about it. Maybe not firing, at least right away, or if you get tricked/someone sneaks in behind you, but put some teeth in the policy and actually enforce it. If the company just says "don't do it" there is still social pressure to be polite and not slam the door in someone's face. But if there are consequences that ev…

In my building, we have a similar tailgating policy, and its quite strict. A sign states that it's a federal offense and that police will be contacted.

At first I thought it was weird, but since being here I've noticed more and more unmarked and federal police vehicles parked downstairs, and several offices/floors that are unlabeled and used mainly by those guys.

I'm guessing there's some kind of diplomatic etc services that go on here which not everyone's privy to.

Re: Should Failing Phish Tests Be a Fireable Offense?

#320

Post by Kalium »

dearrifling wrote: post #318
Kalium wrote: post #195

Earlier quoted context omitted.

Following a link can readily enough expose someone to risks. Phishing isn't always just about entering logins.

That's true for any email, not just phising. Unless you can verify and trust all senders.

Yup. This is why people are taught not to click links in emails for things like banking. It's a dangerous world out there, even for seemingly innocuous things.
Post reply on HN