3 ms·
I genuinely don't put any faith in education. Every phishing education program I've seen has effectively said "look out for weird emails, (perhaps with misspell
by everdrive 5y ago
I genuinely don't put any faith in education. Every phishing education program I've seen has effectively said "look out for weird emails, (perhaps with misspellings) and if you see them report them to security!" I haven't seen any which went into the real specifics which might actually educate users:
- A phishing email which can pwn you without user interaction is basically unheard of.
- Even malicious sites generally can't do anything bad simply by visiting them. (and yes, I'm aware browser exploitation exists, but it is exceedingly rare)
- Ultimately, it's entering your credentials in a malicious site which is what puts users at risk. A user must click a malicious link (sometimes two) and then intentionally enter their credentials into the malicious site.
Between this, and the fact that users must read emails, visit sites, and enter their credentials over and over, just to get through their workday, I believe the outcome is that user education doesn't amount to much. It would be much better if a normal user's workflow didn't usually require clicking on email links and then entering their credentials. The fact that this is required means that even a savvy users will eventually be tired / rushed / working on automatic and get owned.
- carlosf 5y agoWhich is why basic stuff like MFA and MDM (block sign-ins coming from non compliant devices) works wonders against ransomware attacks.
- dcow 5y agoCan't wait for WebAuthN to proliferate.
- shakna 5y ago> A phishing email which can pwn you without user interaction is basically unheard of. If you extend from "email" to the other communication tools that companies use today (and do use for inter-company communications too), there actually have been a number of these in the past year. Outlook [3] had one that didn't require downloading the file, exactly - the "Preview" window from just clicking the attachment once, was enough. Microsoft Teams [0], Jabber [1] and Slack [2] were all hit by real 0-interaction RCEs. [0] https://github.com/oskarsve/ms-teams-rce/blob/main/README.md https://github.com/oskarsve/ms-teams-rce/blob/main/README.md [1] https://nvd.nist.gov/vuln/detail/CVE-2020-3495 https://nvd.nist.gov/vuln/detail/CVE-2020-3495 [2] https://hackerone.com/reports/783877 https://hackerone.com/reports/783877 [3] https://nvd.nist.gov/vuln/detail/CVE-2020-1349 https://nvd.nist.gov/vuln/detail/CVE-2020-1349
- XorNot 5y agoBluecoat proxies are amazing at creating the wrong user behaviour, since when spegno fails all the ones I've seen fallback to basic auth asking for your company network credentials in a basic auth box on the browser.