3 ms·
> Initially, the worker suspected it was a phishing email, as it talked of the need for a secret transaction to be carried out. However, the worker put aside hi
by willsmith72 3y ago
> Initially, the worker suspected it was a phishing email, as it talked of the need for a secret transaction to be carried out. However, the worker put aside his early doubts after the video call because other people in attendance had looked and sounded just like colleagues he recognized.
this is the real problem. why oh why, after suspecting an email as phishing, would you then go on to even click ANYTHING, let alone join a video call?
insanity. either stupidity or he's lying about suspecting the email. how many corporate security trainings does it take? this is just about 101. "if asked to do a secret task by a suspicious email, DONT do it"
- geraldwhen 3y ago“Secret transaction” is in the annual training of annual who handles money. That’s an immediate red flag, escalate to corporate governance officer.
- pavel_lishin 3y ago> how many corporate security trainings does it take? this is just about 101. "if asked to do a secret task by a suspicious email, DONT do it" It takes $CURRENT_NUMBER + 1. People are still, to this day, racking up thousands of dollars in iTunes gift cards on corporate cards and mailing them out, because they got a text from "the CEO". It happened at my spouse's work just last year. It'll continue happening again, forever, because to paraphrase P.T. Barnum, a sucker is hired every minute - in the probability distribution of humanity along that particular axis, there's always going to be some percentage at the bottom who'll fall for the most obvious scams. Sometimes repeatedly.
- IshKebab 3y ago> corporate security trainings Have you ever actually done corporate security training? It's very obviously 100% useless and not going to teach anyone anything. A company I worked for actually started sending test phishing campaigns which is a lot more effective, but I thought they were still pretty obvious and also it led to stupid people reporting them on Slack endlessly. Still, probably the best thing you can do.
- ozr 3y agoFor you and me, yeah the training is useless. For someone actually naive enough to pick up gift cards for the 'CEO'? It could help.
- Havoc 3y ago>It's very obviously 100% useless and not going to teach anyone anything. I've seen some decent ones. e.g. One that was presented from adversaries PoV which I thought was innovative & got people thinking about it in novel ways (at least did for me).
- NoPicklez 3y agoI work in making and sending phishing emails for companies and measuring people's response. Many people will open a suspected phishing link, report it, then open it later in the afternoon...
- therealdrag0 3y agoHow do you know the training is useless?
- teo_zero 3y ago> "if asked to do a secret task by a suspicious email, DONT do it" This is not what they teach you in trainings, though. They teach you to get the requestor (or your boss or whoever might be authoritative) on the line and confirm that the email is authentic. I believe a video call qualifies as well.
- SoftTalker 3y agoDepends on who initiates that video call. If the "boss" calls you and says "did you get the email" that is suspect at least if you don't carefully verify the origin of that call. Basically any communication that you don't initiate might be fake.
- bagels 3y agoThese people trust caller id, but shouldn't, of course.