9 ms·

I explicitly told my penetration testers to avoid anything like this. Invoking and then revoking a bonus email in a year where folks are already hard hit finan

I explicitly told my penetration testers to avoid anything like this. Invoking and then revoking a bonus email in a year where folks are already hard hit financially and mentally under the guise of “education” is lazy and any security leader who does it is a fool. Effective security culture builds rapport with business units. This type of nonsense does the exact opposite. Yes you may have proven a tactical point, but you have just set yourself up to lose the war.

johnghanks 6y ago
wasn't the bonus real, though?
otterley 6y ago
This one is tricky. Effective phishing preys on the weak and the vulnerable. For better or worse, we do have to train people -- even weak and vulnerable people -- not to fall for scams, and there's no better way we know of than to do training exercises. Cruel though it may sound, unless we can think of a better way, I think it's the most effective option. The fact that employees are failing this proves the point, and until we can show that they are no longer falling for it, it shows how vulnerable we remain from an infosec posture.
- galacticaactual 6y ago
  Again, while you may be proving a point and obtain a localized victory, it is Pyrrhic. There are other phishing scenarios that can be tailored for the proclivities of each team. Overdue POs for purchasing. “Hey I saw some source code leaked on this site” for engineering. Etc etc. The only reason you would have to send something like this is because you are lazy, need to generalize quickly, and blast it to the company. And you will teach a lesson. And you will kill any goodwill to the security team as a byproduct.
  - otterley 6y ago
    How would this other form of exercise you propose demonstrate that the staff isn't vulnerable to a fictitious promise of a bonus sent by a malicious outside actor? I disagree that one can characterize the simulation of a specific scenario as "lazy." Is it unusually attractive to the target? Yes. Lazy? No.
    - galacticaactual 6y ago
      Ask yourself what the purpose of proving this point is other than a vanity metric. Then ask yourself whether that should be the actual goal. Because it seems to me the actual goal is to have a workforce with generally high awareness and caution around phishing risks in general - and that can be built without goodwill-destroying tactics like this.
      - otterley 6y ago
        Hey, I'm all for making it better if it's possible! But the evidence isn't clear that other forms of training are effective in stopping an attack that involves this sort of messaging. If there are, great - but we need to prove that out first.
        tsimionescu 6y ago
        No - since you are planning to inflict some harm to your employees, the onus is on you to prove that the harm is warranted. Specifically, you would have to prove that sending phishing training emails with more neutral topics (e.g. a package arrived, IT policy change - ACTION REQUIRED) is less effective than sending the more potentially harmful.
        runarberg 6y ago
        In fact you should first show that fake phishing email are more effective then traditional non-phishing emails that simply warns you about the risk of phishing and gives a clear example of a phishing email without any trickery. Something like: “SECURITY INFORMATION: Phishing emails target holiday bonuses to increase engagement. Always be on alert” along with a few points on what you are likely to see in a phishing email, how you could spot one, and what to do if you get phished.
  - deleted 6y ago
    [deleted]
  - SCHiM 6y ago
    I don't agree with you, but with the other posters in this thread. You can't just pull your punches, phishing and ransomware crime is currently skyrocketing. This is exactly the type of scenario that will entice many people to infect themselves with malware. This is also a scenario I've seen multiple _real_ e-mails of in recent weeks. It's not like your employees are not likely to receive something just as nasty as this over the course of their employ. That said, I do agree with you that money is better spent elsewhere. A company with > 1000 employees should just assume there's an infected machine in their network 24/7. Defense in depth stipulates that this should not matter for their security.
    - galacticaactual 6y ago
      You can, and must, pull your punches and gauge the trade offs when you run a security organization that has to work with and collaborate with other teams. If you truly disagree, I encourage you to replicate this particular test in your organization and see how that works for you.
      - zamadatix 6y ago
        If your company culture is bad enough you fear working on real world security problems with them you've already got a collaboration problem and it's going to preclude any security theater you perform when it comes to actual risk.
        xyzelement 6y ago
        Exactly! I kept having this feeling as I read their replies and you just nailed it. "I can't test the real threat because my users will rebel" might be a real case in his situation but speaks poorly of the company. What other things are they not dealing with head-on?
        eropple 6y ago
        It literally beggars belief that in a time of massive human uncertainty that the active malice of having the company participate in dangling a fake bonus in front of employees is just given this weird shrug. The most good-faith reading of this whole tire fire that I can manage is that if you're going to pull this, you had absolutely and without question better have actual bonuses, of no less and frankly probably more than the phishing attempt, in the pipeline for every employee. If you don't, you should be fired because it is inhumane to act this way to other people. It is, and I do not use this word lightly, evil.
- treeman79 6y ago
  At a certain point people will straight up hate the employer over these sort of things. Result at my work. Email is completely ignored by most everyone. All communication is via Slack, even when not appropriate. I check my email about twice a week, and by the end I’m usually browsing job boards out of disgust.
- runarberg 6y ago
  > there's no better way we know of than to do training exercises Are you sure about that? Is there any evidence that supports this claim? It certainly fails the sniff test. Behavioral science does not hold setting you up for failure as an effective learning contingency. I mean try teaching your dog that way, see how far you’ll go. You will also teach your workers that phishing emails come from internal so there is no need to report it. When I was working as a life guard we never went into training situations unknowingly. There is a reason for that, a) it is dangerous as workers might act irrationally creating a dangerous situation, b) it is stress invoking and not healthy for anyone, especially those that have underlying stress issues or conditions, and c) there is no evidence that live training is any more effective or teaches you anything more than traditional training does.
- deleted 6y ago
  [deleted]
axaxs 6y ago
Why not have both? That is, plan to provide a real bonus and amount, even if it's just 100 bucks. Beforehand, send out said phishing email, and collect data. Provide the bonus to everyone. Once the holiday is over, notify employees who failed the test of how easy it is to prey on people's emotion and to be careful, that email was in fact in no way tied to the bonus.
- mcphage 6y ago
  That might be fine, but that’s not what GoDaddy did.
- deleted 6y ago
  [deleted]
shmageggy 6y ago
GoDaddy doing something unethical?! Color me shocked.
deleted 6y ago
[deleted]
kryogen1c 6y ago
> Yes you may have proven a tactical point, but you have just set yourself up to lose the war. you glossed over this point, but it is nonobvious. how exactly does making your users skeptical of email "lose the war"? are they going to type in their passwords out of spite now? the gp is exactly right. if you have a line you wont cross to train your users, then youre leaving a vulnerability. if you want to make the argument that the vuln is worth not "being mean" to your employees, then make that argument, but don't pretend its more secure.
- bluntfang 6y ago
  if you make your employees feel bad on purpose and have a track record of insensitivity, they won't like you. People who don't like you won't act in your interest to a high capacity. I don't think GP was ambiguous at all, to be honest. This point was extremely clear. It feels like you came to the discussion with an axe to grind.
- WrtCdEvrydy 6y ago
  > if you have a line you wont cross to train your users, then youre leaving a vulnerability. How about a phishing test that downloads something that nukes your hard drive?
  - Supermancho 6y ago
    > > if you have a line you wont cross to train your users, then youre leaving a vulnerability. > How about a phishing test that downloads something that nukes your hard drive? The phishing weakness opens that possibility. The act of wiping the HD does nothing to improve behavior or identify weakness.
  - inerte 6y ago
    How about gov sec launching nuclear attacks on every major country?
  - utucuro 6y ago
    Now that's a good idea - where I work, our security policy is such that I should be able to destroy any (company) computing equipment an end user is using and the loss of data should be restricted to their unsaved changes. A test like you propose would be a very memorable reminder for information security awareness, and so might be really effective before infrastructure upgrades if restricted to people with hardware about to be phased out, you need to nuke old hard drives at that point anyway...
Alex3917 6y ago
> Effective security culture builds rapport with business units. This type of nonsense does the exact opposite. But these emails presumably weren't even coming from the company's domain, since they were phishing emails.
- jdbernard 6y ago
  Unless I misread the article, these were from the company's domain: > Sent by Happyholiday@Godaddy.com
  - Alex3917 6y ago
    You misread the article. The article is saying that the emails said they were from the godaddy.com, but it doesn't say that they were actually sent from godaddy.com.
- horsawlarway 6y ago
  Internal domain, custom image with GoDaddy logo, no obvious spelling problems or mistakes. Go look at the image in the article. I don't work there so maybe something in it should have set off red flags for employees, but generally speaking - That's a very high quality phishing attempt.

johnghanks 6y ago

wasn't the bonus real, though?

otterley 6y ago

This one is tricky. Effective phishing preys on the weak and the vulnerable. For better or worse, we do have to train people -- even weak and vulnerable people -- not to fall for scams, and there's no better way we know of than to do training exercises. Cruel though it may sound, unless we can think of a better way, I think it's the most effective option. The fact that employees are failing this proves the point, and until we can show that they are no longer falling for it, it shows how vulnerable we remain from an infosec posture.

galacticaactual 6y ago
Again, while you may be proving a point and obtain a localized victory, it is Pyrrhic. There are other phishing scenarios that can be tailored for the proclivities of each team. Overdue POs for purchasing. “Hey I saw some source code leaked on this site” for engineering. Etc etc. The only reason you would have to send something like this is because you are lazy, need to generalize quickly, and blast it to the company. And you will teach a lesson. And you will kill any goodwill to the security team as a byproduct.
- otterley 6y ago
  How would this other form of exercise you propose demonstrate that the staff isn't vulnerable to a fictitious promise of a bonus sent by a malicious outside actor? I disagree that one can characterize the simulation of a specific scenario as "lazy." Is it unusually attractive to the target? Yes. Lazy? No.
  - galacticaactual 6y ago
    Ask yourself what the purpose of proving this point is other than a vanity metric. Then ask yourself whether that should be the actual goal. Because it seems to me the actual goal is to have a workforce with generally high awareness and caution around phishing risks in general - and that can be built without goodwill-destroying tactics like this.
    - otterley 6y ago
      Hey, I'm all for making it better if it's possible! But the evidence isn't clear that other forms of training are effective in stopping an attack that involves this sort of messaging. If there are, great - but we need to prove that out first.
      - tsimionescu 6y ago
        No - since you are planning to inflict some harm to your employees, the onus is on you to prove that the harm is warranted. Specifically, you would have to prove that sending phishing training emails with more neutral topics (e.g. a package arrived, IT policy change - ACTION REQUIRED) is less effective than sending the more potentially harmful.
        runarberg 6y ago
        In fact you should first show that fake phishing email are more effective then traditional non-phishing emails that simply warns you about the risk of phishing and gives a clear example of a phishing email without any trickery. Something like: “SECURITY INFORMATION: Phishing emails target holiday bonuses to increase engagement. Always be on alert” along with a few points on what you are likely to see in a phishing email, how you could spot one, and what to do if you get phished.
- deleted 6y ago
  [deleted]
- SCHiM 6y ago
  I don't agree with you, but with the other posters in this thread. You can't just pull your punches, phishing and ransomware crime is currently skyrocketing. This is exactly the type of scenario that will entice many people to infect themselves with malware. This is also a scenario I've seen multiple _real_ e-mails of in recent weeks. It's not like your employees are not likely to receive something just as nasty as this over the course of their employ. That said, I do agree with you that money is better spent elsewhere. A company with > 1000 employees should just assume there's an infected machine in their network 24/7. Defense in depth stipulates that this should not matter for their security.
  - galacticaactual 6y ago
    You can, and must, pull your punches and gauge the trade offs when you run a security organization that has to work with and collaborate with other teams. If you truly disagree, I encourage you to replicate this particular test in your organization and see how that works for you.
    - zamadatix 6y ago
      If your company culture is bad enough you fear working on real world security problems with them you've already got a collaboration problem and it's going to preclude any security theater you perform when it comes to actual risk.
      - xyzelement 6y ago
        Exactly! I kept having this feeling as I read their replies and you just nailed it. "I can't test the real threat because my users will rebel" might be a real case in his situation but speaks poorly of the company. What other things are they not dealing with head-on?
        eropple 6y ago
        It literally beggars belief that in a time of massive human uncertainty that the active malice of having the company participate in dangling a fake bonus in front of employees is just given this weird shrug. The most good-faith reading of this whole tire fire that I can manage is that if you're going to pull this, you had absolutely and without question better have actual bonuses, of no less and frankly probably more than the phishing attempt, in the pipeline for every employee. If you don't, you should be fired because it is inhumane to act this way to other people. It is, and I do not use this word lightly, evil.
treeman79 6y ago
At a certain point people will straight up hate the employer over these sort of things. Result at my work. Email is completely ignored by most everyone. All communication is via Slack, even when not appropriate. I check my email about twice a week, and by the end I’m usually browsing job boards out of disgust.
runarberg 6y ago
> there's no better way we know of than to do training exercises Are you sure about that? Is there any evidence that supports this claim? It certainly fails the sniff test. Behavioral science does not hold setting you up for failure as an effective learning contingency. I mean try teaching your dog that way, see how far you’ll go. You will also teach your workers that phishing emails come from internal so there is no need to report it. When I was working as a life guard we never went into training situations unknowingly. There is a reason for that, a) it is dangerous as workers might act irrationally creating a dangerous situation, b) it is stress invoking and not healthy for anyone, especially those that have underlying stress issues or conditions, and c) there is no evidence that live training is any more effective or teaches you anything more than traditional training does.
deleted 6y ago
[deleted]

axaxs 6y ago

Why not have both? That is, plan to provide a real bonus and amount, even if it's just 100 bucks. Beforehand, send out said phishing email, and collect data. Provide the bonus to everyone. Once the holiday is over, notify employees who failed the test of how easy it is to prey on people's emotion and to be careful, that email was in fact in no way tied to the bonus.

mcphage 6y ago
That might be fine, but that’s not what GoDaddy did.
deleted 6y ago
[deleted]

shmageggy 6y ago

GoDaddy doing something unethical?! Color me shocked.

deleted 6y ago

[deleted]

kryogen1c 6y ago

> Yes you may have proven a tactical point, but you have just set yourself up to lose the war. you glossed over this point, but it is nonobvious. how exactly does making your users skeptical of email "lose the war"? are they going to type in their passwords out of spite now? the gp is exactly right. if you have a line you wont cross to train your users, then youre leaving a vulnerability. if you want to make the argument that the vuln is worth not "being mean" to your employees, then make that argument, but don't pretend its more secure.

bluntfang 6y ago
if you make your employees feel bad on purpose and have a track record of insensitivity, they won't like you. People who don't like you won't act in your interest to a high capacity. I don't think GP was ambiguous at all, to be honest. This point was extremely clear. It feels like you came to the discussion with an axe to grind.
WrtCdEvrydy 6y ago
> if you have a line you wont cross to train your users, then youre leaving a vulnerability. How about a phishing test that downloads something that nukes your hard drive?
- Supermancho 6y ago
  > > if you have a line you wont cross to train your users, then youre leaving a vulnerability. > How about a phishing test that downloads something that nukes your hard drive? The phishing weakness opens that possibility. The act of wiping the HD does nothing to improve behavior or identify weakness.
- inerte 6y ago
  How about gov sec launching nuclear attacks on every major country?
- utucuro 6y ago
  Now that's a good idea - where I work, our security policy is such that I should be able to destroy any (company) computing equipment an end user is using and the loss of data should be restricted to their unsaved changes. A test like you propose would be a very memorable reminder for information security awareness, and so might be really effective before infrastructure upgrades if restricted to people with hardware about to be phased out, you need to nuke old hard drives at that point anyway...

Alex3917 6y ago

> Effective security culture builds rapport with business units. This type of nonsense does the exact opposite. But these emails presumably weren't even coming from the company's domain, since they were phishing emails.

jdbernard 6y ago
Unless I misread the article, these were from the company's domain: > Sent by Happyholiday@Godaddy.com
- Alex3917 6y ago
  You misread the article. The article is saying that the emails said they were from the godaddy.com, but it doesn't say that they were actually sent from godaddy.com.
horsawlarway 6y ago
Internal domain, custom image with GoDaddy logo, no obvious spelling problems or mistakes. Go look at the image in the article. I don't work there so maybe something in it should have set off red flags for employees, but generally speaking - That's a very high quality phishing attempt.