5 ms·

I remember it vividly. Because I had to tell someone not to do it this morning. And twice last week. Few times the month before that. Even configured Exchange

by dvtrn 5y ago

I remember it vividly. Because I had to tell someone not to do it this morning. And twice last week. Few times the month before that. Even configured Exchange to give people a “report suspected phishing” button in their outlook clients. They keep on clickin’. (Each time was a different person btw)

deltarholamda 5y ago
According to the Codified Laws of System Administrators, you are now authorized to start lopping off fingers.
- spockz 5y ago
  I think they will still be clicking with their noses in that case. It never ceases to amaze me how many people think. “Oh hey that interesting/cool <click>”. Or “hey how did they know I needed this?”
  - kingcharles 5y ago
    Headstick is the way to go once your sysadmin has taken all your digits. Gotta click 'em all! https://www.youtube.com/watch?v=Rz2HpGC9vbw https://www.youtube.com/watch?v=Rz2HpGC9vbw
deleted 5y ago
[deleted]
Nextgrid 5y ago
There are companies providing fake phishing messages as a service. Use those and attach penalties for repeat idiots. If they don't care about putting the company at risk, they might at least think about putting their own employment at risk. Edit following the comments: maybe reversing the approach would work, by attaching monetary rewards to correctly reporting phishing emails? That would encourage everyone to be extra suspicious and report anything that looks amiss for the chance of getting some extra cash while avoiding the negatives of firing people on sight.
- acdha 5y ago
  That’s a good way to ensure everyone hates ITSec for punishing them despite having failed to provide an environment which is secure enough to survive someone clicking on a link in an email. That makes it less likely that people will report suspicious activity and gives a successful attacker a way to blackmail someone. This time is much better spent securing the environment: spend the money on Yubikeys, lock down your default browser or use an isolation system, beef up your network filtering, etc. — things which can actually work and won’t make your users think you’re just trying to get them fired.
  - Nextgrid 5y ago
    The problem I see with locking things down is that you can't lock down things that the user requires for their job. If the user legitimately needs access to some sensitive information for example, it's just a matter of time before they can be tricked by an attacker into doing something stupid with it. Yubikeys would solve the problem of the user giving away their credentials to the sensitive data but wouldn't stop the user directly giving away said sensitive data. Locking down is also a blacklist approach where you can miss something and it will be exploited when an attacker eventually gets lucky. I'd rather be the one getting lucky and catching those users early than waiting for an attacker to catch them. I guess instead of a penalty a more user-friendly way would be to attach monetary rewards to reporting phishing emails? That would incentivize reporting anything that looks even just slightly suspicious, which is probably a better outcome from a security point of view even with false positives.
- _jal 5y ago
  You really don't want to do that. We use one of those services, too, and you have to use a very light touch. Just using them at all makes people paranoid. If there are people you find who pose a risk, yes, you should do something about that, but terrorizing your workforce is a terrible idea for multiple reasons. > putting their own employment at risk Even looking at it amorally, that only really works in declining industries where people don't have a choice. Do that to engineers in a hot economy, and I suspect you'll be employing only the otherwise-unemployable soon.
acdha 5y ago
In fairness, how many times per day do they get legitimate messages which have unsolicited attachments or user-hostile opaque click-tracking links? Most places would have much easier phishing training if there weren’t so many exceptions.
- BenjiWiebe 5y ago
  My healthcare.gov emails have links through lnks.gd. I have to disable it umatrix and ubo to even follow the link. :)
- anitil 5y ago
  At my old job we all reported a suspicious email with links that didn't match who the service said they were. Turns out it was the link to our mandatory security training portal. Of all the people to get it wrong....
- leephillips 5y ago
  Why are those exceptions?
  - ReactiveJelly 5y ago
    The people who care about security are out-numbered by and have less authority than the people who don't
  - acdha 5y ago
    Because security isn’t a priority at most organizations and outsourcing further diffuses accountability. This is why I would usually focus on things like WebAuthn (making phishing much harder) or locking down the default browser environment more so it takes more than one click to cause a major problem. That doesn’t prevent social engineering, of course, but that requires a lot more work and gives more time for other safeguards to work.
- _huayra_ 5y ago
  A lot of the HR-y systems and other things being not hosted on-prem and moved to salesforce or something means a lot of random click-through links in legitimate emails, e.g. to take some "totally anonymous survey" at work or vote on some questions for the next "roundtable with the VPs". So many of these companies have URLs that are not related to their domain for these short links, and it just leaves me scratching my head. clicktrack.legitdomain.com was eschewed for your shortlinks in favor of link-track-service.net?

by dvtrn 5y ago

deltarholamda 5y ago

According to the Codified Laws of System Administrators, you are now authorized to start lopping off fingers.

spockz 5y ago
I think they will still be clicking with their noses in that case. It never ceases to amaze me how many people think. “Oh hey that interesting/cool <click>”. Or “hey how did they know I needed this?”
- kingcharles 5y ago
  Headstick is the way to go once your sysadmin has taken all your digits. Gotta click 'em all! https://www.youtube.com/watch?v=Rz2HpGC9vbw https://www.youtube.com/watch?v=Rz2HpGC9vbw

deleted 5y ago

[deleted]

Nextgrid 5y ago

There are companies providing fake phishing messages as a service. Use those and attach penalties for repeat idiots. If they don't care about putting the company at risk, they might at least think about putting their own employment at risk. Edit following the comments: maybe reversing the approach would work, by attaching monetary rewards to correctly reporting phishing emails? That would encourage everyone to be extra suspicious and report anything that looks amiss for the chance of getting some extra cash while avoiding the negatives of firing people on sight.

acdha 5y ago
That’s a good way to ensure everyone hates ITSec for punishing them despite having failed to provide an environment which is secure enough to survive someone clicking on a link in an email. That makes it less likely that people will report suspicious activity and gives a successful attacker a way to blackmail someone. This time is much better spent securing the environment: spend the money on Yubikeys, lock down your default browser or use an isolation system, beef up your network filtering, etc. — things which can actually work and won’t make your users think you’re just trying to get them fired.
- Nextgrid 5y ago
  The problem I see with locking things down is that you can't lock down things that the user requires for their job. If the user legitimately needs access to some sensitive information for example, it's just a matter of time before they can be tricked by an attacker into doing something stupid with it. Yubikeys would solve the problem of the user giving away their credentials to the sensitive data but wouldn't stop the user directly giving away said sensitive data. Locking down is also a blacklist approach where you can miss something and it will be exploited when an attacker eventually gets lucky. I'd rather be the one getting lucky and catching those users early than waiting for an attacker to catch them. I guess instead of a penalty a more user-friendly way would be to attach monetary rewards to reporting phishing emails? That would incentivize reporting anything that looks even just slightly suspicious, which is probably a better outcome from a security point of view even with false positives.
_jal 5y ago
You really don't want to do that. We use one of those services, too, and you have to use a very light touch. Just using them at all makes people paranoid. If there are people you find who pose a risk, yes, you should do something about that, but terrorizing your workforce is a terrible idea for multiple reasons. > putting their own employment at risk Even looking at it amorally, that only really works in declining industries where people don't have a choice. Do that to engineers in a hot economy, and I suspect you'll be employing only the otherwise-unemployable soon.

acdha 5y ago

In fairness, how many times per day do they get legitimate messages which have unsolicited attachments or user-hostile opaque click-tracking links? Most places would have much easier phishing training if there weren’t so many exceptions.

BenjiWiebe 5y ago
My healthcare.gov emails have links through lnks.gd. I have to disable it umatrix and ubo to even follow the link. :)
anitil 5y ago
At my old job we all reported a suspicious email with links that didn't match who the service said they were. Turns out it was the link to our mandatory security training portal. Of all the people to get it wrong....
leephillips 5y ago
Why are those exceptions?
- ReactiveJelly 5y ago
  The people who care about security are out-numbered by and have less authority than the people who don't
- acdha 5y ago
  Because security isn’t a priority at most organizations and outsourcing further diffuses accountability. This is why I would usually focus on things like WebAuthn (making phishing much harder) or locking down the default browser environment more so it takes more than one click to cause a major problem. That doesn’t prevent social engineering, of course, but that requires a lot more work and gives more time for other safeguards to work.
_huayra_ 5y ago
A lot of the HR-y systems and other things being not hosted on-prem and moved to salesforce or something means a lot of random click-through links in legitimate emails, e.g. to take some "totally anonymous survey" at work or vote on some questions for the next "roundtable with the VPs". So many of these companies have URLs that are not related to their domain for these short links, and it just leaves me scratching my head. clicktrack.legitdomain.com was eschewed for your shortlinks in favor of link-track-service.net?