3 ms·

Corporate security theater in general is starting to get out of hand. I just had to take a yearly sec training, and the videos are absurdly over-the-top. I can

Corporate security theater in general is starting to get out of hand. I just had to take a yearly sec training, and the videos are absurdly over-the-top. I can imagine them being quite alarming for people who don't have the technical background to know what is actually important. Just a series of videos trying to conjure up this strange sense of paranoia -- telling us that "HACKERS" are CONSTANTLY trying to 'break in,' and will try to SOCIAL ENGINEER us by reading everything they can find on our facebooks! Advice such as, "If a friend posts a picture of you without your permission, consider asking them to remove it." How does that relate to corporate security in the slightest? The kicker was when they told us that, if our mobile devices become more than a few years old, we just had to buy new ones in order to stay secure. I was flabbergasted. This is speaking about our own personal devices, not company-issued ones. Seriously, the gall to make people think the only way to be safe is to spend hundreds of dollars on new phones every 2 years. It's just bizarre, and it's never been applicable in any of my workplaces. And I have worked for large, global law firms on quite famous litigation with huge international conglomerates as clients -- as a poorly paid grunt, not an associate, but that just meant I had more direct access to sensitive documents. I've probably received ~100 "phishy" emails over the years, and zero of them have been actual phishing attempts. Just more of that "the molesters are waiting around every corner and hiding behind every tree" nonsense, now migrated into the workplace.

Schweigi 8y ago
A lot of financial related phishing emails use info gathered from social networks. The attackers use it to see who does what in the company and to come up with a nice email to someone in the finance department. Sure there is a lot of security theater but I think its important to understand that for attackers its definitely worth to spend a couple of hours on research. A successful email can quickly reach a 5 figures reward. Source: I work in email security
dvfjsdhgfv 8y ago
It's because phishing works, and the success rate is a combination of the right message and the number of attempts. Of course smart people will notice right away, but how to discern who is smart and who is not before the incident happens? To make sure you make everyone undergo the training. As for the smartphone example: they could just have said to make sure you always have the most recent version of the OS, which is quite easy if you own a certain brand of smartphones, and can be frustratingly difficult if you use something else. I'm sorry to say but they were right: most vendors don't care for customers who have devices older than a few years because they don't bring them any money. It's a general problem in the industry, nothing surprisingly new.

Schweigi 8y ago

A lot of financial related phishing emails use info gathered from social networks. The attackers use it to see who does what in the company and to come up with a nice email to someone in the finance department. Sure there is a lot of security theater but I think its important to understand that for attackers its definitely worth to spend a couple of hours on research. A successful email can quickly reach a 5 figures reward. Source: I work in email security

dvfjsdhgfv 8y ago

It's because phishing works, and the success rate is a combination of the right message and the number of attempts. Of course smart people will notice right away, but how to discern who is smart and who is not before the incident happens? To make sure you make everyone undergo the training. As for the smartphone example: they could just have said to make sure you always have the most recent version of the OS, which is quite easy if you own a certain brand of smartphones, and can be frustratingly difficult if you use something else. I'm sorry to say but they were right: most vendors don't care for customers who have devices older than a few years because they don't bring them any money. It's a general problem in the industry, nothing surprisingly new.