5 ms·

I agree absolutely. It's similar to previous companies I've worked at that do phishing test emails for all their employees (usually at 9am on a Monday). There's

I agree absolutely. It's similar to previous companies I've worked at that do phishing test emails for all their employees (usually at 9am on a Monday). There's little evidence it works, it is security theater and generally harms productivity. Knowing when not to bother people about security can be really helpful.

bplankers 8y ago
Followed immediately by HR sending an unsigned email about critical deadlines for benefits or something, telling you to click a link and/or a PDF attachment.
- kovrik 8y ago
  So the real issue here is not emails or autoresponders, but lack of IT security knowledge among employees. Hence, do (mandatory) trainings or something.
  - Moodles 8y ago
    I'm not sure there's much evidence that it works though. Probably more effective is having employees use yubikeys or something.
- gizmo686 8y ago
  The most obvious phishing email I ever received was from some random domain informing me I had not take the required anti-phishing tracking and to please click the link to take it. Like a good employee, I sent the email to our spam@ account and didn't give it any more thought. A month later, my manager comes in and informs me that the anti-phishing training is not optional and I had a week to complete it.
  - cwyers 8y ago
    That's amazing.
  - Wowfunhappy 8y ago
    At a large company, shouldn't someone be monitoring the address where people report phishing, who can tell you if a reported message is legitimate? I work at a small company, so I don't know if this is how any IRL organizations work, but it's how I assumed the procedure went.
    - TeMPOraL 8y ago
      Anecdote time: At one of my previous jobs, there was this big part of intranet that was used by sysadmins, and various other people from fields other than software development. My team didn't have to deal with it, so we weren't even aware of it, much less had access to it. One day, however, someone wanted me to review a document from there. I bounced off the "Unauthorized" error, and dutifully followed the instructions to fill in an appropriate box with a justification, and send a request to be granted access. The issue wasn't critical, so I didn't pester anyone about it, just patiently waited for the access, re-filing my request every other month. Many months later, with me still not getting access, I eventually brought this up to my boss, who then smiled and told me that this access request form literally goes to /dev/null. Apparently after some software migration, no one bothered to connect this to anything.
  - kiallmacinnes 8y ago
    Back when I worked at HP, our anti-phishing training even had a joke in it about how, yes, all HP URLs look exactly like the phising URLs they were describing... What's with https://h20195.www2.hpe.com/ https://h20195.www2.hpe.com/? Why?
- maxxxxx 8y ago
  In my company a lot of systems like HR have gone from internal servers to cloud so E-mails come from a lot of different URLs as sender. I consider myself pretty savvy but if a mail looks halfways plausible I don't really know how to tell if it's legitimate or not. The only way to fix this would be to sign E-mails so we can verify authenticity. I think it shouldn't be too hard to write an Outlook plugin to do this.
  - kovrik 8y ago
    If I am not sure whether an email is legitimate or not, then I just ignore it assuming that if it is something real and important, then the other party will find a way to contact me (send another email, call me, approach me in person etc.).
    - maxxxxx 8y ago
      With stuff like information about health insurance or 401k information there won't be any follow-up but it's very important to me.
      - wahern 8y ago
        Those are easy. Just log into the portal directly. Imagine if someone from your benefits provider called and asked for your social security number or other PII for confirmation. Would you give it to them? I hope not. You should ask (as I always do) for their name and extension and tell them that you'll return their call through a published telephone number. Never once have I had someone balk at that, and I've done it countless times for many years. For a link to a benefits provider, it's trivial to log into the portal through a known good domain and look around for whatever piece of information or news they were trying to communicate. The hard issues come with all the random services HR contracts for stuff like harassment training, etc. If I can't corroborate a link myself then as a last resort I can simply ask HR (or w'ever department) directly, or as previously said just ignore it and wait for someone to say something. At some point the usage of so many third-party services is just an insane security risk. It's almost comical when the corp security team runs a phishing test and on the same day you get a half-dozen e-mail messages from other departments with twice as many links to random domains. At some point you're just like, "fsck 'em" and have half a mind to not bother caring anymore. But it's not just their security on the line, it's yours, too. I still use mutt for personal e-mail so maybe this is all easier for me. I've yet to become accustomed to hidden links or embedded multimedia in e-mail.
- sct202 8y ago
  Our security team makes their phishing emails look way too professional.
  - jobigoud 8y ago
    Targeted phishing for corporate espionnage would look very professional. Even regular bank phishing is getting very pro these days. https://krebsonsecurity.com/2018/10/voice-phishing-scams-are-getting-more-clever/ https://krebsonsecurity.com/2018/10/voice-phishing-scams-are...
tptacek 8y ago
I've watched phishing exercise emails work (where by "work" I mean "marked increase in reports of real phishing attempts"), so I'm not sure that's the best example of theatrical corpsec practices.
- philwelch 8y ago
  Possibly stupid question: Is there any fundamental reason your corporate email system couldn't, for example, just not interoperate with the rest of the Internet, at least by default? I understand if this doesn't work for people in sales or consulting or whatever, but 90-99% of my work email is entirely within the same company, and I think it would be less onerous and more secure to just block external email by default and use a separate, secured system when you had to email anyone outside the company.
  - EamonnMR 8y ago
    You might as well use IRC/Slack/HipChat rather than trying to set up your own isolated MX.
    - philwelch 8y ago
      Unless you actually want email instead of chat.
  - nvr219 8y ago
    What we do (and a lot of companies do) is append [EXT] to the subject line of any incoming message from outside the org. Blocking external email by default will drive people to use their personal gmail for work.
    - wwn_se 8y ago
      Clearly denoting if the email is unsafe is great. If there is a lot of communication with a few outside orgs then a whitelist could be used
    - carlmr 8y ago
Gene_Parmesan 8y ago
Corporate security theater in general is starting to get out of hand. I just had to take a yearly sec training, and the videos are absurdly over-the-top. I can imagine them being quite alarming for people who don't have the technical background to know what is actually important. Just a series of videos trying to conjure up this strange sense of paranoia -- telling us that "HACKERS" are CONSTANTLY trying to 'break in,' and will try to SOCIAL ENGINEER us by reading everything they can find on our facebooks! Advice such as, "If a friend posts a picture of you without your permission, consider asking them to remove it." How does that relate to corporate security in the slightest? The kicker was when they told us that, if our mobile devices become more than a few years old, we just had to buy new ones in order to stay secure. I was flabbergasted. This is speaking about our own personal devices, not company-issued ones. Seriously, the gall to make people think the only way to be safe is to spend hundreds of dollars on new phones every 2 years. It's just bizarre, and it's never been applicable in any of my workplaces. And I have worked for large, global law firms on quite famous litigation with huge international conglomerates as clients -- as a poorly paid grunt, not an associate, but that just meant I had more direct access to sensitive documents. I've probably received ~100 "phishy" emails over the years, and zero of them have been actual phishing attempts. Just more of that "the molesters are waiting around every corner and hiding behind every tree" nonsense, now migrated into the workplace.
- Schweigi 8y ago
  A lot of financial related phishing emails use info gathered from social networks. The attackers use it to see who does what in the company and to come up with a nice email to someone in the finance department. Sure there is a lot of security theater but I think its important to understand that for attackers its definitely worth to spend a couple of hours on research. A successful email can quickly reach a 5 figures reward. Source: I work in email security
- dvfjsdhgfv 8y ago
  It's because phishing works, and the success rate is a combination of the right message and the number of attempts. Of course smart people will notice right away, but how to discern who is smart and who is not before the incident happens? To make sure you make everyone undergo the training. As for the smartphone example: they could just have said to make sure you always have the most recent version of the OS, which is quite easy if you own a certain brand of smartphones, and can be frustratingly difficult if you use something else. I'm sorry to say but they were right: most vendors don't care for customers who have devices older than a few years because they don't bring them any money. It's a general problem in the industry, nothing surprisingly new.

bplankers 8y ago

Followed immediately by HR sending an unsigned email about critical deadlines for benefits or something, telling you to click a link and/or a PDF attachment.

kovrik 8y ago
So the real issue here is not emails or autoresponders, but lack of IT security knowledge among employees. Hence, do (mandatory) trainings or something.
- Moodles 8y ago
  I'm not sure there's much evidence that it works though. Probably more effective is having employees use yubikeys or something.
gizmo686 8y ago
The most obvious phishing email I ever received was from some random domain informing me I had not take the required anti-phishing tracking and to please click the link to take it. Like a good employee, I sent the email to our spam@ account and didn't give it any more thought. A month later, my manager comes in and informs me that the anti-phishing training is not optional and I had a week to complete it.
- cwyers 8y ago
  That's amazing.
- Wowfunhappy 8y ago
  At a large company, shouldn't someone be monitoring the address where people report phishing, who can tell you if a reported message is legitimate? I work at a small company, so I don't know if this is how any IRL organizations work, but it's how I assumed the procedure went.
  - TeMPOraL 8y ago
    Anecdote time: At one of my previous jobs, there was this big part of intranet that was used by sysadmins, and various other people from fields other than software development. My team didn't have to deal with it, so we weren't even aware of it, much less had access to it. One day, however, someone wanted me to review a document from there. I bounced off the "Unauthorized" error, and dutifully followed the instructions to fill in an appropriate box with a justification, and send a request to be granted access. The issue wasn't critical, so I didn't pester anyone about it, just patiently waited for the access, re-filing my request every other month. Many months later, with me still not getting access, I eventually brought this up to my boss, who then smiled and told me that this access request form literally goes to /dev/null. Apparently after some software migration, no one bothered to connect this to anything.
- kiallmacinnes 8y ago
  Back when I worked at HP, our anti-phishing training even had a joke in it about how, yes, all HP URLs look exactly like the phising URLs they were describing... What's with https://h20195.www2.hpe.com/ https://h20195.www2.hpe.com/? Why?
maxxxxx 8y ago
In my company a lot of systems like HR have gone from internal servers to cloud so E-mails come from a lot of different URLs as sender. I consider myself pretty savvy but if a mail looks halfways plausible I don't really know how to tell if it's legitimate or not. The only way to fix this would be to sign E-mails so we can verify authenticity. I think it shouldn't be too hard to write an Outlook plugin to do this.
- kovrik 8y ago
  If I am not sure whether an email is legitimate or not, then I just ignore it assuming that if it is something real and important, then the other party will find a way to contact me (send another email, call me, approach me in person etc.).
  - maxxxxx 8y ago
    With stuff like information about health insurance or 401k information there won't be any follow-up but it's very important to me.
    - wahern 8y ago
      Those are easy. Just log into the portal directly. Imagine if someone from your benefits provider called and asked for your social security number or other PII for confirmation. Would you give it to them? I hope not. You should ask (as I always do) for their name and extension and tell them that you'll return their call through a published telephone number. Never once have I had someone balk at that, and I've done it countless times for many years. For a link to a benefits provider, it's trivial to log into the portal through a known good domain and look around for whatever piece of information or news they were trying to communicate. The hard issues come with all the random services HR contracts for stuff like harassment training, etc. If I can't corroborate a link myself then as a last resort I can simply ask HR (or w'ever department) directly, or as previously said just ignore it and wait for someone to say something. At some point the usage of so many third-party services is just an insane security risk. It's almost comical when the corp security team runs a phishing test and on the same day you get a half-dozen e-mail messages from other departments with twice as many links to random domains. At some point you're just like, "fsck 'em" and have half a mind to not bother caring anymore. But it's not just their security on the line, it's yours, too. I still use mutt for personal e-mail so maybe this is all easier for me. I've yet to become accustomed to hidden links or embedded multimedia in e-mail.
sct202 8y ago
Our security team makes their phishing emails look way too professional.
- jobigoud 8y ago
  Targeted phishing for corporate espionnage would look very professional. Even regular bank phishing is getting very pro these days. https://krebsonsecurity.com/2018/10/voice-phishing-scams-are-getting-more-clever/ https://krebsonsecurity.com/2018/10/voice-phishing-scams-are...

tptacek 8y ago

I've watched phishing exercise emails work (where by "work" I mean "marked increase in reports of real phishing attempts"), so I'm not sure that's the best example of theatrical corpsec practices.

philwelch 8y ago
Possibly stupid question: Is there any fundamental reason your corporate email system couldn't, for example, just not interoperate with the rest of the Internet, at least by default? I understand if this doesn't work for people in sales or consulting or whatever, but 90-99% of my work email is entirely within the same company, and I think it would be less onerous and more secure to just block external email by default and use a separate, secured system when you had to email anyone outside the company.
- EamonnMR 8y ago
  You might as well use IRC/Slack/HipChat rather than trying to set up your own isolated MX.
  - philwelch 8y ago
    Unless you actually want email instead of chat.
- nvr219 8y ago
  What we do (and a lot of companies do) is append [EXT] to the subject line of any incoming message from outside the org. Blocking external email by default will drive people to use their personal gmail for work.
  - wwn_se 8y ago
    Clearly denoting if the email is unsafe is great. If there is a lot of communication with a few outside orgs then a whitelist could be used
  - carlmr 8y ago

Gene_Parmesan 8y ago

Corporate security theater in general is starting to get out of hand. I just had to take a yearly sec training, and the videos are absurdly over-the-top. I can imagine them being quite alarming for people who don't have the technical background to know what is actually important. Just a series of videos trying to conjure up this strange sense of paranoia -- telling us that "HACKERS" are CONSTANTLY trying to 'break in,' and will try to SOCIAL ENGINEER us by reading everything they can find on our facebooks! Advice such as, "If a friend posts a picture of you without your permission, consider asking them to remove it." How does that relate to corporate security in the slightest? The kicker was when they told us that, if our mobile devices become more than a few years old, we just had to buy new ones in order to stay secure. I was flabbergasted. This is speaking about our own personal devices, not company-issued ones. Seriously, the gall to make people think the only way to be safe is to spend hundreds of dollars on new phones every 2 years. It's just bizarre, and it's never been applicable in any of my workplaces. And I have worked for large, global law firms on quite famous litigation with huge international conglomerates as clients -- as a poorly paid grunt, not an associate, but that just meant I had more direct access to sensitive documents. I've probably received ~100 "phishy" emails over the years, and zero of them have been actual phishing attempts. Just more of that "the molesters are waiting around every corner and hiding behind every tree" nonsense, now migrated into the workplace.

Schweigi 8y ago
A lot of financial related phishing emails use info gathered from social networks. The attackers use it to see who does what in the company and to come up with a nice email to someone in the finance department. Sure there is a lot of security theater but I think its important to understand that for attackers its definitely worth to spend a couple of hours on research. A successful email can quickly reach a 5 figures reward. Source: I work in email security
dvfjsdhgfv 8y ago
It's because phishing works, and the success rate is a combination of the right message and the number of attempts. Of course smart people will notice right away, but how to discern who is smart and who is not before the incident happens? To make sure you make everyone undergo the training. As for the smartphone example: they could just have said to make sure you always have the most recent version of the OS, which is quite easy if you own a certain brand of smartphones, and can be frustratingly difficult if you use something else. I'm sorry to say but they were right: most vendors don't care for customers who have devices older than a few years because they don't bring them any money. It's a general problem in the industry, nothing surprisingly new.