4 ms·

The sad part is it's one of the hardest components to solve. High quality training can instill a healthy dose of paranoia, that is necessary, though.

Enginerrrd 4y ago
I'm convinced there's no way to solve this except for regular "red shirt drills" linked to your job performance. (This is a term I borrowed from life-guarding where someone randomly pretends to drown to see if/how fast the guard will catch it and assess the skills of their response.)
- nibbleshifter 4y ago
  Even that doesn't work - some companies do exactly that with regular phishing exercises etc. Employees get really good at spotting the tests.
  - syrrim 4y ago
    If being able to spot the tests doesn't confer ability to spot real phishers, then the tests aren't very good.
  - AviationAtom 4y ago
    The technical ones may, but they're also less likely to fall victim to the phishing schemes. It's those non-technical folks in admin roles that you tend to have to worry about most. Those folks aren't so good at picking out the tests. I actually found KnowBe4 to work fairly well on a large scale.
    - nibbleshifter 4y ago
      The non technical staff seem to learn to spot the knowbe4 shit real quick lol.
      - jabroni_salad 4y ago
        Yep. All of KB4s stuff looks like it came from a single designer. You need to go through your spam filter and make custom templates from whatever you are receiving, and also make lookalikes from real business messages. Bankers doing wire transfers to wrong accounts because of a forged document has been a serious problem in my sphere lately. It used to be that if a mailbox got compromised they would just send spam about lottery wins and boner pills. Now they watch your messages and reply to a real request with a good looking response. A correct expected reply in a chain from an authentic account, just some numbers have changed. Then they will steal your contacts and register a similar domain and try to impersonate you.
        AviationAtom 4y ago
        We had almost this exact scenario (look alike domain) play out with a customer. Their accounts payable department almost paid out half a million to a scammer. Fortunately the employee at the customer accidentally replied to our actual email address and our folks knew better and picked up the phone. The customer insisted up and down that their email system had not been compromised. It took telling their IT folks what and where to look before they finally realized they were compromised. Good IT/security teams make all the difference.
        Enginerrrd 4y ago
        > A correct expected reply in a chain from an authentic account, just some numbers have changed. Ooof, that'd be a tough one not to fall for.
      - AviationAtom 4y ago
        It's all in how much effort you put into it. It's quite versatile and their customer success team is phenomenal. We had multiple pretty smart employees accidentally fall for it the first few campaigns and immediately reach out when they realized what they did.
  - yjftsjthsd-h 4y ago
    > Employees get really good at spotting the tests. Then surely either the test isn't good enough, or the problem is solved?
- AviationAtom 4y ago
  Good detection and response is a must, but creating a security culture helps greatly. Training, test campaigns, and further training for those that fail, does help. Nothing is a silver bullet, that is why we emphasize "Defense in Depth."
- codetrotter 4y ago
  > a term I borrowed from life-guarding where someone randomly pretends to drown to see if/how fast the guard will catch it and assess the skills of their response They have a similar concept in cybersecurity. The Red Team > a group that plays the role of an enemy or competitor to provide security feedback from that perspective. Red teams are used in many fields, especially in cybersecurity, airport security, law enforcement, the military and intelligence agencies. https://en.wikipedia.org/wiki/Red_team https://en.wikipedia.org/wiki/Red_team
jacquesm 4y ago
It is. And then you receive mails from say Google or some other large company that look exactly as though they are very bad forgeries of what you'd expect. 'Action required', some weird vaguely related domain name, a bunch of links to click that definitely have nothing to do with the matter at hand. With crap like that it isn't all that strange that some of these attempts get through and on the social engineering side it can't be all that much better. After all we're continuously conditioned to trust that which we really shouldn't be trusting. Right up to the point where the party on the other side is abusing that trust. One example: my real bank calling me and then asking me to verify that it is really me by asking me all kinds of information about my account... And from a number that isn't associated with them. And yet, it was very real and when I refused to answer their questions they took it pretty badly as though I was a scammer...

Enginerrrd 4y ago

I'm convinced there's no way to solve this except for regular "red shirt drills" linked to your job performance. (This is a term I borrowed from life-guarding where someone randomly pretends to drown to see if/how fast the guard will catch it and assess the skills of their response.)

nibbleshifter 4y ago
Even that doesn't work - some companies do exactly that with regular phishing exercises etc. Employees get really good at spotting the tests.
- syrrim 4y ago
  If being able to spot the tests doesn't confer ability to spot real phishers, then the tests aren't very good.
- AviationAtom 4y ago
  The technical ones may, but they're also less likely to fall victim to the phishing schemes. It's those non-technical folks in admin roles that you tend to have to worry about most. Those folks aren't so good at picking out the tests. I actually found KnowBe4 to work fairly well on a large scale.
  - nibbleshifter 4y ago
    The non technical staff seem to learn to spot the knowbe4 shit real quick lol.
    - jabroni_salad 4y ago
      Yep. All of KB4s stuff looks like it came from a single designer. You need to go through your spam filter and make custom templates from whatever you are receiving, and also make lookalikes from real business messages. Bankers doing wire transfers to wrong accounts because of a forged document has been a serious problem in my sphere lately. It used to be that if a mailbox got compromised they would just send spam about lottery wins and boner pills. Now they watch your messages and reply to a real request with a good looking response. A correct expected reply in a chain from an authentic account, just some numbers have changed. Then they will steal your contacts and register a similar domain and try to impersonate you.
      - AviationAtom 4y ago
        We had almost this exact scenario (look alike domain) play out with a customer. Their accounts payable department almost paid out half a million to a scammer. Fortunately the employee at the customer accidentally replied to our actual email address and our folks knew better and picked up the phone. The customer insisted up and down that their email system had not been compromised. It took telling their IT folks what and where to look before they finally realized they were compromised. Good IT/security teams make all the difference.
      - Enginerrrd 4y ago
        > A correct expected reply in a chain from an authentic account, just some numbers have changed. Ooof, that'd be a tough one not to fall for.
    - AviationAtom 4y ago
      It's all in how much effort you put into it. It's quite versatile and their customer success team is phenomenal. We had multiple pretty smart employees accidentally fall for it the first few campaigns and immediately reach out when they realized what they did.
- yjftsjthsd-h 4y ago
  > Employees get really good at spotting the tests. Then surely either the test isn't good enough, or the problem is solved?
AviationAtom 4y ago
Good detection and response is a must, but creating a security culture helps greatly. Training, test campaigns, and further training for those that fail, does help. Nothing is a silver bullet, that is why we emphasize "Defense in Depth."
codetrotter 4y ago
> a term I borrowed from life-guarding where someone randomly pretends to drown to see if/how fast the guard will catch it and assess the skills of their response They have a similar concept in cybersecurity. The Red Team > a group that plays the role of an enemy or competitor to provide security feedback from that perspective. Red teams are used in many fields, especially in cybersecurity, airport security, law enforcement, the military and intelligence agencies. https://en.wikipedia.org/wiki/Red_team https://en.wikipedia.org/wiki/Red_team

jacquesm 4y ago

It is. And then you receive mails from say Google or some other large company that look exactly as though they are very bad forgeries of what you'd expect. 'Action required', some weird vaguely related domain name, a bunch of links to click that definitely have nothing to do with the matter at hand. With crap like that it isn't all that strange that some of these attempts get through and on the social engineering side it can't be all that much better. After all we're continuously conditioned to trust that which we really shouldn't be trusting. Right up to the point where the party on the other side is abusing that trust. One example: my real bank calling me and then asking me to verify that it is really me by asking me all kinds of information about my account... And from a number that isn't associated with them. And yet, it was very real and when I refused to answer their questions they took it pretty badly as though I was a scammer...