4 ms·

The sophistication of attacks is rising exponentially. "Spear phishing" has pretty much become the norm, all our new hires get an email from our "CEO" pretendin

The sophistication of attacks is rising exponentially. "Spear phishing" has pretty much become the norm, all our new hires get an email from our "CEO" pretending they have to sign paper work for their equity... Its part of our onboarding now to warn them that if they join our LinkedIn they will get multiple phishing attempts from the "founders".

moepstar 4y ago
> Its part of our onboarding now to warn them that if they join our LinkedIn they will get multiple phishing attempts from the "founders". Hm, i wonder what the point is to warn them beforehand?
- whylo 4y ago
  I think OP means that new hires are receiving actual spearphishing emails from attackers outside of the company, not that they're testing them by sending fake spearphising emails. (I misread it as the latter at first too)
  - moepstar 4y ago
    Ha - thanks for clarifying - now that i read it over again... you're probably right and it even makes sense to do so...
  - haswell 4y ago
    I'm not sure if they ever did this during onboarding, but my former employer would regularly run fake spearphishing campaigns to raise awareness about spearphishing. The number of people who regularly fell for it was worrisome. Falling for it meant auto-enrollment in a mandatory security awareness training. Failing to take the training would result in deactivation of the individual's network credentials. I don't know if these campaigns are actually effective at changing people's behavior, but they certainly revealed how effective spearphishing is.
- bearjaws 4y ago
  The main problem is they are real attacks that 100% happen as soon as they update their LinkedIn. They aren't tests like a Knowb4.
indymike 4y ago
All that is going on is that hackers are learning about how telephony works and weaponizing it. No different than social networks and email. It is time to move off of email and SMS as 2fa.
elric 4y ago
We have a web page which lists every single tool/service we use, and we actively encourage people to check whether unfamiliar links are listed on that page. I've considered creating a browser plugin which marks the address bar red/green when you're on URLs the company (dis)trusts. Seems like this would be something that should exist already.

moepstar 4y ago

> Its part of our onboarding now to warn them that if they join our LinkedIn they will get multiple phishing attempts from the "founders". Hm, i wonder what the point is to warn them beforehand?

whylo 4y ago
I think OP means that new hires are receiving actual spearphishing emails from attackers outside of the company, not that they're testing them by sending fake spearphising emails. (I misread it as the latter at first too)
- moepstar 4y ago
  Ha - thanks for clarifying - now that i read it over again... you're probably right and it even makes sense to do so...
- haswell 4y ago
  I'm not sure if they ever did this during onboarding, but my former employer would regularly run fake spearphishing campaigns to raise awareness about spearphishing. The number of people who regularly fell for it was worrisome. Falling for it meant auto-enrollment in a mandatory security awareness training. Failing to take the training would result in deactivation of the individual's network credentials. I don't know if these campaigns are actually effective at changing people's behavior, but they certainly revealed how effective spearphishing is.
bearjaws 4y ago
The main problem is they are real attacks that 100% happen as soon as they update their LinkedIn. They aren't tests like a Knowb4.

indymike 4y ago

All that is going on is that hackers are learning about how telephony works and weaponizing it. No different than social networks and email. It is time to move off of email and SMS as 2fa.

elric 4y ago

We have a web page which lists every single tool/service we use, and we actively encourage people to check whether unfamiliar links are listed on that page. I've considered creating a browser plugin which marks the address bar red/green when you're on URLs the company (dis)trusts. Seems like this would be something that should exist already.