Live data from Hacker News

Should Failing Phish Tests Be a Fireable Offense?

krebsonsecurity.com

341–350 of 357 posts

Re: Should Failing Phish Tests Be a Fireable Offense?

#341
post #317

Earlier quoted context omitted.

Deliverability is pretty trivial to prove, and if they knew enough to get something in your inbox they probably already knew enough to be confident of that anyway. With regard to wget: 15 vulnerability’s in the last 20 years for such a highly used peace of software doesn’t scare me that much, and I can easily run it from a sandboxed container or vm since I’m using those all the time anyway. And if I don’t want to con…

OK. How should we - I - go about this differently? Adults are perfectly capable of believing that their expertise extends further than it actually does and taking risks they do not fully understand or appreciate. I see it daily in the developers I work with. I have worked with more than one developer brimming with confidence in their ability to tackle areas beyond their expertise, who will try to engineer on-the-fly…

It would start by taking an honest assessment of what the other person actually knows before you make blanket statements about what they don't know. I mean, don't get me wrong I'm not personally insulted, but in my case you have zero idea what my actual expertise is but you're already telling me that retrieving link is beyond what I can safely handle -- and you literally have no idea what my experience is. (I used to work in security!) Part of my job as a developer is security, I need to know attack vectors people use, so that sites I build aren't vulnerable, and besides that, I'm not some criminal mastermind but you don't even know if when I was younger I had fun hacking people and creating mischief. Point being, you can't come at people with this blanket statement of "you have no idea what you're dealing with!" because YOU don't know what they know. If you do that you're going to lose their empathy and attention before you even communicate what you want to communicate.

Here's what you can do: tell them what can go wrong, with specifics, and don't make assumptions about them. Be realistic about what the likely consequences are and what the worst case is.

If we wanted perfect security we'd never connect machines to the internet and superglue the usb ports shut. But in a realistic world, the level of security we choose is measure against how much risk we're willing to take. Lets say my risk profile is this: I don't work for the NSA and I'm not important enough that someone is going to try a unique zero day exploit on me. But it would be trivial to figure out my work email based on my linked in and my name, so I don't really care about them discovering deliver-ability. If the phishing attempt is bad, I'll probably spot it immediately and not bother to even open the email, but if it's good I'll probably at least investigate because I'll want to know if it was a legitimate email. Chances are, they're just trying to convince me to type my password into a web form (and assuming I use the same password everywhere). Of course, chances are also that, just based on my past experiences, about 90% of phishing attempts come from corporate security departments anyway. If someone really has a very clever zero day exploit of wget then they'll get access to a container with little sensitive data that I rebuild about a hundred times a day.

Yes it's not my hardware, but on the other hand, my company has entrusted me with local admin to get my work done and use of the internet. That's the risk profile they're comfortable with, and sometimes I get external emails and need to figure out if they are legit or not, and I don't work for a giant company with a huge security department so sometimes I need to take a glance to see if it's a legit email or not.

Re: Should Failing Phish Tests Be a Fireable Offense?

#342

Earlier quoted context omitted.

You can wave any object at the sensor. Maybe an unauthorized tag will yield a different beep or make the light flash a different color. Maybe the person in front of you will be in a position to see the light on the reader, maybe they'll notice, and maybe they'll consider it odd. Getting that far, and then actually deciding to challenge you or report it, is a vanishingly small chance. There is no point in badging an u…

Agree. The whole idea of 'challenging tailgating' falls apart because someone walking in after you is not performing a strange act. You would have to actively close the door _on_ people, including your colleagues, which goes against social norms to such an extreme extent that it's just not happening.

Right, which is why you need a more secure system of entry. I've worked in finance and defense. Finance used turnstiles, defense used some light in person security.

Re: Should Failing Phish Tests Be a Fireable Offense?

#343

Phish tests need to be fair to people who actually understand something about security. "Opening an email" is not actually an issue (spearphishers that sit on drive-by 0-days in current browsers or email programs are not a threat model that most orgs can possibly defend against). Opening attachements is hard to measure and again needs context: What kind of software and sandbox was the attachement opened with? Attacke…

This definitely needs to be considered. I open WSL and use curl on suspicious looking email links. I've been logged as doing so before. I'd hate for that log to actually go somewhere significant.

It might be worth considering carefully how safe the practice of opening essentially random email links might be. Are you opening the links with a full suite of forensic measures in place, or are you dropping curl $URL into your terminal on your workstation? It looks like WSL isn't exactly a sandbox. It does seem to already be used by some malware: https://research.checkpoint.com/beware-bashware-new-method-m...

In a world with drive-by exploits and where opening a link leaks information, it perhaps could be considered unsafe to open essentially random links from emails. I've definitely worked with developers who seem to believe that curl is magical and inures them against every possible attack.

Curiosity is a wonderful thing! It's just sometimes it can be dangerous to a person and to the people around them. It might not be a bad thing for people to learn a smidge of caution.

Re: Should Failing Phish Tests Be a Fireable Offense?

#344
post #317

Earlier quoted context omitted.

OK. How should we - I - go about this differently? Adults are perfectly capable of believing that their expertise extends further than it actually does and taking risks they do not fully understand or appreciate. I see it daily in the developers I work with. I have worked with more than one developer brimming with confidence in their ability to tackle areas beyond their expertise, who will try to engineer on-the-fly…

It would start by taking an honest assessment of what the other person actually knows before you make blanket statements about what they don't know. I mean, don't get me wrong I'm not personally insulted, but in my case you have zero idea what my actual expertise is but you're already telling me that retrieving link is beyond what I can safely handle -- and you literally have no idea what my experience is. (I used to…

That's an excellent and highly empathetic approach!

My only issue with what you've described is that I cannot scale it. When I have hundreds of developers to educate, sitting down with each of them and spending hours hashing out what they do and don't know and educating them over the gaps can at times become somewhat time-consuming.

How do I deal with hundreds of developers, the vast majority of whom have no significant background in security, many of whom earnestly and honestly believe that their understanding of web development protects them? How do I collectively treat them like adults and not lose their empathy or attention in a scalable way? A highly individualized approach isn't workable in this context.

Re: Should Failing Phish Tests Be a Fireable Offense?

#345

Earlier quoted context omitted.

...and now we see why such policies are bad, and it's even covered in the article: while people falling for phishing are bad, what's even worse is when they fall for it and don't report. Creating a culture where the security is the enemy is _not_ good. I mean, sure, if it's 20 times, we're getting into outrageous territory and you have reasons to suspect employee is trolling you. But other than that, the reality is t…

This can be equalized by having a perk or bonus on reporting phishing attacks to IT. Anything from casual Friday (for offices that are not relaxed wear) to a Starbucks card or whatever. IMHO the act of timely reporting the click on a phishing email should negate the email click penalty. The idea is make the wanted behavior pleasurable and the unwanted ones painful.

[deleted]

Re: Should Failing Phish Tests Be a Fireable Offense?

#346

Earlier quoted context omitted.

...and now we see why such policies are bad, and it's even covered in the article: while people falling for phishing are bad, what's even worse is when they fall for it and don't report. Creating a culture where the security is the enemy is _not_ good. I mean, sure, if it's 20 times, we're getting into outrageous territory and you have reasons to suspect employee is trolling you. But other than that, the reality is t…

This can be equalized by having a perk or bonus on reporting phishing attacks to IT. Anything from casual Friday (for offices that are not relaxed wear) to a Starbucks card or whatever. IMHO the act of timely reporting the click on a phishing email should negate the email click penalty. The idea is make the wanted behavior pleasurable and the unwanted ones painful.

> This can be equalized by having a perk or bonus on reporting phishing attacks to IT.

...there is no way you can equalise "you're going to lose your job" with anything less than "we're going to give you enough money that you won't really need the job anymore."

And with a Starbucks card or casual Friday? I'm not even sure if you're being serious, because that sounds like a joke.

Re: Should Failing Phish Tests Be a Fireable Offense?

#348
post #238

Earlier quoted context omitted.

I don't think any company's policy requires every employee to physically stop the tailgater. It would be enough that she e.g. alert security to the situation.

And security should immediately be able to review security camera footage at that entrance.

Right, because anything with video surveillance has the immediate full attention of a human.

Re: Should Failing Phish Tests Be a Fireable Offense?

#349
post #348

Earlier quoted context omitted.

And security should immediately be able to review security camera footage at that entrance.

Right, because anything with video surveillance has the immediate full attention of a human.

Not immediate, but they have been tipped off by the employee who made the call, as you noted, so they can review the most recent video from just a few minutes ago for the specific corridor where that employee was tailgated.

Re: Should Failing Phish Tests Be a Fireable Offense?

#350
post #348

Earlier quoted context omitted.

Right, because anything with video surveillance has the immediate full attention of a human.

Not immediate, but they have been tipped off by the employee who made the call, as you noted, so they can review the most recent video from just a few minutes ago for the specific corridor where that employee was tailgated.

Ah I think I misunderstood your comment.
Post reply on HN