4 ms·

I'm not sure I follow what you mean by auditing. Do you mean tracking whether employees fall for fake phishing attacks organized by the training companies? Ever

by geofft 5y ago

I'm not sure I follow what you mean by auditing. Do you mean tracking whether employees fall for fake phishing attacks organized by the training companies? Everywhere I've worked that runs these campaigns, they do track whether people "Fall" for them, but the fake phishing attacks are easy to spot a mile away because they were poorly done, and there's no reason to believe that real phishing attacks look anything like them. (They also measure the wrong thing, such as whether people click on the link - which is totally fine, the whole point of a web browser is to click links - and not whether they give up credentials or install software.) If someone is auditing whether employees are falling for real phishing attacks, that's interesting and I'd be curious to know more about that product.

krageon 5y ago
Clicking a suspected phishing link is a failure, given the absolutely ridiculous amount of potential malware vectors such a site can have. Of course, a good phishing audit also tracks whether or not credentials are leaked (and ideally whether or not these credentials could be real). With "audits" I refer to checkups that policies are being followed. As for whether or not your phishing audits are good, I cannot say :) I have seen some very good ones, as the best audits are based on (different tiers of) successful phishing campaigns seen in real life. If you feel that your company could do better, you could always try to speak to your security team about this. It helps the people working there as much as it helps the company, folks falling for phishing happens in all walks of life.
- geofft 5y ago
  > Clicking a suspected phishing link is a failure, given the absolutely ridiculous amount of potential malware vectors such a site can have. This is absolutely untrue and it is phishing-vendor propaganda. If there are any "potential malware vectors" from visiting a website, there are so many other ways you are exposed to those "vectors". For instance, Hacker News is a website that features links to arbitrary user-submitted website. Any click on a website on Hacker News could expose you to all the same "vectors." (Maybe that's why nobody here reads the article before commenting?) If an attacker has a way to get malware to you based on your browser accessing some web page and rendering it, they have so many easier ways to do that. They can buy ads leading to the web page they control. They can make organic content that highly ranks a web page they control. They can even render custom iframes inside tweets (https://developer.twitter.com/en/docs/twitter-for-websites/cards/overview/player-card https://developer.twitter.com/en/docs/twitter-for-websites/c...) and promote the tweet. If you're concerned about browser zero-days - and you should be! - phishing is the least of your worries. Automatic browser and OS updates with very short remediation times and aggressive policies on BYOD devices staying up to date will get you a lot farther. And these policies are actually genuinely compatible with the jobs of a lot of people who, well, have to click on links to do their jobs. If you fall for the phishing-vendor propaganda, you'll end up with people trained not to click on links that look like phishing links but who will happily click on links that don't (because their job requires them to), which defeats the point entirely. Hence my question about whether you're measuring results from the phishing vendor, who is incentivized to tell you that paying them is doing something worthwhile, or from actual phishers. Finally, TFA was about spear-phishing and about convincing people to do things, not about distributing malware. A "don't click on links" security culture does nothing to protect against "don't trust emails that tell you to do wire transfers." I have in fact spoken to my security team and convinced them to stop running phishing tests that mark clicking the website as a failure, based on exactly the above reasoning.
  - krageon 5y ago
    > you'll end up with people trained not to click on links that look like phishing links but who will happily click on links that don't This is fair. I'll think about it and do some more research. It'd be nice to be wrong, in this case :) > A "don't click on links" security culture does nothing to protect against "don't trust emails that tell you to do wire transfers." I thought this spoke for itself, but just in case: You can do both. A good policy takes all reasonable steps, of which these are good examples.

by geofft 5y ago

krageon 5y ago

Clicking a suspected phishing link is a failure, given the absolutely ridiculous amount of potential malware vectors such a site can have. Of course, a good phishing audit also tracks whether or not credentials are leaked (and ideally whether or not these credentials could be real). With "audits" I refer to checkups that policies are being followed. As for whether or not your phishing audits are good, I cannot say :) I have seen some very good ones, as the best audits are based on (different tiers of) successful phishing campaigns seen in real life. If you feel that your company could do better, you could always try to speak to your security team about this. It helps the people working there as much as it helps the company, folks falling for phishing happens in all walks of life.

geofft 5y ago
> Clicking a suspected phishing link is a failure, given the absolutely ridiculous amount of potential malware vectors such a site can have. This is absolutely untrue and it is phishing-vendor propaganda. If there are any "potential malware vectors" from visiting a website, there are so many other ways you are exposed to those "vectors". For instance, Hacker News is a website that features links to arbitrary user-submitted website. Any click on a website on Hacker News could expose you to all the same "vectors." (Maybe that's why nobody here reads the article before commenting?) If an attacker has a way to get malware to you based on your browser accessing some web page and rendering it, they have so many easier ways to do that. They can buy ads leading to the web page they control. They can make organic content that highly ranks a web page they control. They can even render custom iframes inside tweets (https://developer.twitter.com/en/docs/twitter-for-websites/cards/overview/player-card https://developer.twitter.com/en/docs/twitter-for-websites/c...) and promote the tweet. If you're concerned about browser zero-days - and you should be! - phishing is the least of your worries. Automatic browser and OS updates with very short remediation times and aggressive policies on BYOD devices staying up to date will get you a lot farther. And these policies are actually genuinely compatible with the jobs of a lot of people who, well, have to click on links to do their jobs. If you fall for the phishing-vendor propaganda, you'll end up with people trained not to click on links that look like phishing links but who will happily click on links that don't (because their job requires them to), which defeats the point entirely. Hence my question about whether you're measuring results from the phishing vendor, who is incentivized to tell you that paying them is doing something worthwhile, or from actual phishers. Finally, TFA was about spear-phishing and about convincing people to do things, not about distributing malware. A "don't click on links" security culture does nothing to protect against "don't trust emails that tell you to do wire transfers." I have in fact spoken to my security team and convinced them to stop running phishing tests that mark clicking the website as a failure, based on exactly the above reasoning.
- krageon 5y ago
  > you'll end up with people trained not to click on links that look like phishing links but who will happily click on links that don't This is fair. I'll think about it and do some more research. It'd be nice to be wrong, in this case :) > A "don't click on links" security culture does nothing to protect against "don't trust emails that tell you to do wire transfers." I thought this spoke for itself, but just in case: You can do both. A good policy takes all reasonable steps, of which these are good examples.