4 ms·

> Yes you may have proven a tactical point, but you have just set yourself up to lose the war. you glossed over this point, but it is nonobvious. how exactly d

> Yes you may have proven a tactical point, but you have just set yourself up to lose the war. you glossed over this point, but it is nonobvious. how exactly does making your users skeptical of email "lose the war"? are they going to type in their passwords out of spite now? the gp is exactly right. if you have a line you wont cross to train your users, then youre leaving a vulnerability. if you want to make the argument that the vuln is worth not "being mean" to your employees, then make that argument, but don't pretend its more secure.

bluntfang 6y ago
if you make your employees feel bad on purpose and have a track record of insensitivity, they won't like you. People who don't like you won't act in your interest to a high capacity. I don't think GP was ambiguous at all, to be honest. This point was extremely clear. It feels like you came to the discussion with an axe to grind.
WrtCdEvrydy 6y ago
> if you have a line you wont cross to train your users, then youre leaving a vulnerability. How about a phishing test that downloads something that nukes your hard drive?
- Supermancho 6y ago
  > > if you have a line you wont cross to train your users, then youre leaving a vulnerability. > How about a phishing test that downloads something that nukes your hard drive? The phishing weakness opens that possibility. The act of wiping the HD does nothing to improve behavior or identify weakness.
- inerte 6y ago
  How about gov sec launching nuclear attacks on every major country?
- utucuro 6y ago
  Now that's a good idea - where I work, our security policy is such that I should be able to destroy any (company) computing equipment an end user is using and the loss of data should be restricted to their unsaved changes. A test like you propose would be a very memorable reminder for information security awareness, and so might be really effective before infrastructure upgrades if restricted to people with hardware about to be phased out, you need to nuke old hard drives at that point anyway...
  - jcims 6y ago
    Not exactly related but 7-8 years ago a company in the region had a major virus outbreak. There was some kind of zero day worm running through their environment and despite having updated endpoint protection they still got got. They didn't feel they had any choice but to hire about 50 temp folks from a local contracting company and run through the entire desktop environment and pull drives, re-image, reinstall. They did this over the course of a weekend and on Monday when employees came back they found their desktops wiped clean. Within an hour the site lead started getting calls and visits from panic stricken employees that had kept all sorts of personal info on those machines...photos, emails, documents, etc. All gone. They ended up missing one machine that got powered up that Monday and re-infected the entire campus. Had to do the same thing again.
- leetcrew 6y ago
  some people run scripts that deliberately kill prod nodes at random to test for resiliency.
watwut 6y ago
You are teaching your users that security teams are assholes who deserve whatever petty revenge is possible. And people will treat you like that, most often behind your back.
mcphage 6y ago
> how exactly does making your users skeptical of email "lose the war"? are they going to type in their passwords out of spite now? No, they’re going to quit, or put less effort into their job (which is often worse for the employer than quitting), or tell other people not to work there, or—as in this case—tell everyone on the internet what you did and then your company’s reputation takes a well deserved hit.
- runarberg 6y ago
  Or they will learn not to trust any email they receive. Or they will learn that phishing email come from internal training, and therefor do not need to be reported.
horsawlarway 6y ago
>if you want to make the argument that the vuln is worth not "being mean" to your employees, then make that argument, but don't pretend its more secure. This is not a good scam. People fucking notice when they expect a 650 dollar bonus and it doesn't come. It's not some arbitrary "check out this cool link" style email that an employee might click and then forget they've ever engaged with. Not to mention that it caught nearly 10% of the fucking company - That's an insanely high click through for any phishing test I've ever seen at a software company. And I don't even know if they sent it to all 7k employees (my guess is no). So either GoDaddy has incredibly incompetent employees, or this looked fairly real (and the email does actually look pretty damn good for a phishing email - custom image, no spelling mistakes, internal domain, aware of different geos the company operates in) So you pissed of 10% of your company with an email that wouldn't ever be sent as a real scam (because a week later the employee is going to ask where the 650 bucks is and alarm bells will go off). I don't have the context of a Godaddy employee, so maybe there's an obvious mistake in there, but general speaking - this was a dumb play by the security team. It's now also losing them goodwill in public.
- stu2b50 6y ago
  Phishing doesn't have to be a literal scam. The more insidious kind that companies are actually wary of are the ones intended to steal credentials and get into internal systems. Phishers can easily get what internal company emails look like. Send an email that looks like "Hey, we're giving you a $900 bonus. Make sure to fill out these forms on workday", with a link that is a Phishing website that looks exactly like workday. Fill in your credentials - hey, also need your 2factor code - and bam, hackers have an in to the system. It doesn't matter that the employee realizes 10 days later they were phished.
  - horsawlarway 6y ago
    It absolutely does matter that they realize a week later. Security is like an onion - It's layered into place across different levels, and different systems. If you just want access to a single employee's machine, for a short duration - sure this would work. If you really want to compromise the whole internal net, it's going to take longer than a few hours to work your way into other systems. Generally you either need your target to access the system you want, or you have to spread to other machines to find a machine with the access you need. The most effective attacks are the ones that get in, and have weeks to spread through the whole internal network. Take the Target breach in 2013 - They were in the system undetected for 20 days, nearly 3 weeks. As soon as the company knows they have a problem, any decent security team is going to check every system on record.
deleted 6y ago
[deleted]
0xbadcafebee 6y ago
Fake phishing is not some great methodology to better security, it's a tool to embarrass people and hope that that embarrassment leads to better security, like the Wall of Sheep. (Which, by the way, don't anyone ever implement that at work) Know what doesn't build better security culture? Trying to trick your users. Know what does? Working with them closely to help them understand security, finding out when and how people get tricked, and working to solve those issues. The anti-phishing efforts I've seen so far have been lame and ineffective. Rather than trying to find new ways to make people fail, security teams should be finding new ways to prevent people from falling victim.

bluntfang 6y ago

if you make your employees feel bad on purpose and have a track record of insensitivity, they won't like you. People who don't like you won't act in your interest to a high capacity. I don't think GP was ambiguous at all, to be honest. This point was extremely clear. It feels like you came to the discussion with an axe to grind.

WrtCdEvrydy 6y ago

> if you have a line you wont cross to train your users, then youre leaving a vulnerability. How about a phishing test that downloads something that nukes your hard drive?

Supermancho 6y ago
> > if you have a line you wont cross to train your users, then youre leaving a vulnerability. > How about a phishing test that downloads something that nukes your hard drive? The phishing weakness opens that possibility. The act of wiping the HD does nothing to improve behavior or identify weakness.
inerte 6y ago
How about gov sec launching nuclear attacks on every major country?
utucuro 6y ago
Now that's a good idea - where I work, our security policy is such that I should be able to destroy any (company) computing equipment an end user is using and the loss of data should be restricted to their unsaved changes. A test like you propose would be a very memorable reminder for information security awareness, and so might be really effective before infrastructure upgrades if restricted to people with hardware about to be phased out, you need to nuke old hard drives at that point anyway...
- jcims 6y ago
  Not exactly related but 7-8 years ago a company in the region had a major virus outbreak. There was some kind of zero day worm running through their environment and despite having updated endpoint protection they still got got. They didn't feel they had any choice but to hire about 50 temp folks from a local contracting company and run through the entire desktop environment and pull drives, re-image, reinstall. They did this over the course of a weekend and on Monday when employees came back they found their desktops wiped clean. Within an hour the site lead started getting calls and visits from panic stricken employees that had kept all sorts of personal info on those machines...photos, emails, documents, etc. All gone. They ended up missing one machine that got powered up that Monday and re-infected the entire campus. Had to do the same thing again.
leetcrew 6y ago
some people run scripts that deliberately kill prod nodes at random to test for resiliency.

watwut 6y ago

You are teaching your users that security teams are assholes who deserve whatever petty revenge is possible. And people will treat you like that, most often behind your back.

mcphage 6y ago

> how exactly does making your users skeptical of email "lose the war"? are they going to type in their passwords out of spite now? No, they’re going to quit, or put less effort into their job (which is often worse for the employer than quitting), or tell other people not to work there, or—as in this case—tell everyone on the internet what you did and then your company’s reputation takes a well deserved hit.

runarberg 6y ago
Or they will learn not to trust any email they receive. Or they will learn that phishing email come from internal training, and therefor do not need to be reported.

horsawlarway 6y ago

>if you want to make the argument that the vuln is worth not "being mean" to your employees, then make that argument, but don't pretend its more secure. This is not a good scam. People fucking notice when they expect a 650 dollar bonus and it doesn't come. It's not some arbitrary "check out this cool link" style email that an employee might click and then forget they've ever engaged with. Not to mention that it caught nearly 10% of the fucking company - That's an insanely high click through for any phishing test I've ever seen at a software company. And I don't even know if they sent it to all 7k employees (my guess is no). So either GoDaddy has incredibly incompetent employees, or this looked fairly real (and the email does actually look pretty damn good for a phishing email - custom image, no spelling mistakes, internal domain, aware of different geos the company operates in) So you pissed of 10% of your company with an email that wouldn't ever be sent as a real scam (because a week later the employee is going to ask where the 650 bucks is and alarm bells will go off). I don't have the context of a Godaddy employee, so maybe there's an obvious mistake in there, but general speaking - this was a dumb play by the security team. It's now also losing them goodwill in public.

stu2b50 6y ago
Phishing doesn't have to be a literal scam. The more insidious kind that companies are actually wary of are the ones intended to steal credentials and get into internal systems. Phishers can easily get what internal company emails look like. Send an email that looks like "Hey, we're giving you a $900 bonus. Make sure to fill out these forms on workday", with a link that is a Phishing website that looks exactly like workday. Fill in your credentials - hey, also need your 2factor code - and bam, hackers have an in to the system. It doesn't matter that the employee realizes 10 days later they were phished.
- horsawlarway 6y ago
  It absolutely does matter that they realize a week later. Security is like an onion - It's layered into place across different levels, and different systems. If you just want access to a single employee's machine, for a short duration - sure this would work. If you really want to compromise the whole internal net, it's going to take longer than a few hours to work your way into other systems. Generally you either need your target to access the system you want, or you have to spread to other machines to find a machine with the access you need. The most effective attacks are the ones that get in, and have weeks to spread through the whole internal network. Take the Target breach in 2013 - They were in the system undetected for 20 days, nearly 3 weeks. As soon as the company knows they have a problem, any decent security team is going to check every system on record.

deleted 6y ago

[deleted]

0xbadcafebee 6y ago

Fake phishing is not some great methodology to better security, it's a tool to embarrass people and hope that that embarrassment leads to better security, like the Wall of Sheep. (Which, by the way, don't anyone ever implement that at work) Know what doesn't build better security culture? Trying to trick your users. Know what does? Working with them closely to help them understand security, finding out when and how people get tricked, and working to solve those issues. The anti-phishing efforts I've seen so far have been lame and ineffective. Rather than trying to find new ways to make people fail, security teams should be finding new ways to prevent people from falling victim.