3 ms·
Two issues with this: 1) no mention of U2F; vastly superior to OTP 2) “watch out for phishing” is near useless advice. A well-written phishing email will catc
by wepple 3y ago
Two issues with this:
1) no mention of U2F; vastly superior to OTP
2) “watch out for phishing” is near useless advice. A well-written phishing email will catch the most seasoned security professional. The only fix is: see #1 above
- worksonmine 3y ago> A well-written phishing email will catch the most seasoned security professional. I disagree, this "most seasoned security professional" won't reply to that e-mail if "nobody will ever ask for your credentials on any channel" is part of the hygiene. No matter how well written it is, even if the CEO got his actual legit e-mail hijacked it should not work. Follow proper procedures or fuck off is the only valid answer.
- wepple 3y agoI’ve never ever run a phishing campaign against a medium+ sized organization and had zero hits. It’s great that you think you could never be conned, but I’d be interested if you think that scales to your entire security team. A well-timed, creative phishing campaign can include things like a “regarding your employment status” right after the company announces layoffs, if you’re talking malicious actor and not watered-down security awareness exercise
- worksonmine 3y agoWe are all very aware of what to watch out for and I trust that anyone with dangerous access is aware, but we're a small shop. I know that humans are the weak link, but my definition of a "seasoned security professional" is not the average Joe that would fall for it. Will some security people fall for it? Absolutely, but they don't deserve the title "seasoned". Especially not if always being cautious of phishing is part of their training/on-boarding. I'd say it makes that rule essential instead of useless.