4 ms·

Speaking strictly as a non-technical employee at an org that does this regularly, I view the practice as anti-pattern, un-educative and denigrating. Should we

Speaking strictly as a non-technical employee at an org that does this regularly, I view the practice as anti-pattern, un-educative and denigrating. Should we place dummy card skimmers on gas pumps to teach people to be cautious of credit card fraud? Would you conduct a similar campaign over the phone or in person? Don't lie to your dependents. Secure your infra.

stainablesteel 3y ago
i completely disagree, its definitely educational to people in demographics who fall for these things. and its less denigrating than the real thing. and the dummy skimmers on gas pumps isn't a bad idea, there's a lot of people who have probably still never heard of them, although maybe videos would reach a wider audience for this one as having this irl could cause actual problems. whereas fake phishing emails to vulnerable customers will force them to wisen up. even if its something that shouldn't need to be implemented at your bank, because there are better solutions, it can still help them elsewhere in life.
- seemaze 3y ago
  I absolutely support education around digital hygiene and online security, I just see the method discussed as behavioral operant conditioning, not pro-active education. To take the example to the absurd, should we entrap people to teach them not to commit crimes? I'm also not arguing that it is ineffective, I just view it as morally ambiguous and sowing distrust.
01HNNWZ0MV43FF 3y ago
What infra security prevents your customer from typing their password and TOTP code into someone else's website?
- seemaze 3y ago
  I was referring to an internal org with the ability to employ, e.g. DNS white/blacklisting, URL protection, hardware keys, and not sending official links requesting passwords and TOTP in the first place. As far as customers go, good luck. I'd drop a business that treated me this way without a second thought. The method only works if administered from a position of authority.
captn3m0 3y ago
One way to do this right is to do trainings first, inform employees about future campaigns, and to only ever use reports from phishing campaigns in the aggregate to improve the training. You will never be able to block 100% of legit phishing attempts, your employee alertness is another layer of defence.
leros 3y ago
I've seen an interesting trend at multiple companies. The security team starts sending phishing emails to the employees and if you get phished you have take a training. Simultaneously, HR and executives send company wide emails from third party domains because security won't let them setup email tools on the main domain. As a result, employees start reporting HR and executive emails as phishing and lots of corporate communication breaks down.

stainablesteel 3y ago

i completely disagree, its definitely educational to people in demographics who fall for these things. and its less denigrating than the real thing. and the dummy skimmers on gas pumps isn't a bad idea, there's a lot of people who have probably still never heard of them, although maybe videos would reach a wider audience for this one as having this irl could cause actual problems. whereas fake phishing emails to vulnerable customers will force them to wisen up. even if its something that shouldn't need to be implemented at your bank, because there are better solutions, it can still help them elsewhere in life.

seemaze 3y ago
I absolutely support education around digital hygiene and online security, I just see the method discussed as behavioral operant conditioning, not pro-active education. To take the example to the absurd, should we entrap people to teach them not to commit crimes? I'm also not arguing that it is ineffective, I just view it as morally ambiguous and sowing distrust.

01HNNWZ0MV43FF 3y ago

What infra security prevents your customer from typing their password and TOTP code into someone else's website?

seemaze 3y ago
I was referring to an internal org with the ability to employ, e.g. DNS white/blacklisting, URL protection, hardware keys, and not sending official links requesting passwords and TOTP in the first place. As far as customers go, good luck. I'd drop a business that treated me this way without a second thought. The method only works if administered from a position of authority.

captn3m0 3y ago

One way to do this right is to do trainings first, inform employees about future campaigns, and to only ever use reports from phishing campaigns in the aggregate to improve the training. You will never be able to block 100% of legit phishing attempts, your employee alertness is another layer of defence.

leros 3y ago

I've seen an interesting trend at multiple companies. The security team starts sending phishing emails to the employees and if you get phished you have take a training. Simultaneously, HR and executives send company wide emails from third party domains because security won't let them setup email tools on the main domain. As a result, employees start reporting HR and executive emails as phishing and lots of corporate communication breaks down.