Alt text: Michael Scott Handshake meme. Managers text: “My company Congratulating me on avoiding a phishing test email”. Michael Scott text: “Me, terminally behind on answering email.”

  • Kalkaline
    link
    fedilink
    385 months ago

    “Let’s also make our users follow really complex password requirements but have our password creation/change page be different from the actual login screen so they have a really hard time using a password manager”-dumbass IT department

    • Zoidsberg
      link
      fedilink
      185 months ago

      Change your password every 30 days, and never reuse one, and don’t use a password manager, and don’t write it down anywhere, and…

    • BeardedSingleMalt
      link
      fedilink
      145 months ago

      15 character minimum passwords that expire every 90 days and require MFA to remote in from home with 3 separate login sessions just to get to your PC, along with stripped down rights for everyone, even IS. The rights are so strict that if you wanted to, for instance, update a trusted application like Notepad++ because a recent exploit was found which would be a security concern, you can’t use the auto-update feature of the application; you have to download it manually from their repository, and run it using a special admin account created for you that doesn’t have an associated email address but also has a 90 day password requirement. But you wouldn’t been able to use their repository 6 months ago because we block any IP address outside the US and their previous service was located in UK, so if you wanted to keep that piece of software up-to-date with security and vulnerability patches (which they’ve harped on a number of times before) you’d have to find alternative download services located in the US regardless of how shady.

      I wish I was joking.

    • Edgarallenpwn [they/them]
      link
      fedilink
      English
      65 months ago

      My current employer actually just changed our password policy to greatly extend the password expiration date. We have cranked up the password requirements a tad, every login has 2FA and permissions are locked down to the size of a gnats asshole. Users seem to like it better since they don’t have to come up with a new password as often and we are telling ourselves it’s harder to brute force.

  • @SPRUNT@lemmy.world
    link
    fedilink
    265 months ago

    My company sent me a fishing test email from a “no-reply@companyname.com” email address. I sent it to our security department and asked if I would ever get legitimate emails from that address. They never responded except to say that I passed the phishing test, so I set up a filter to automatically forward emails from that to our security department with a message questioning its validity. Let’s security tell me if emails are legit or not.

    • @Concave1142@lemmy.world
      link
      fedilink
      115 months ago

      My normal method is I will hit the phishing attempt icon that IT Security added to our Outlook on anything that I did not request or sign up for.

      I’m sure the IT Security person who saw all the “free gift card” emails had a great Christmas if they claimed all the gift cards emails they deem legit.

  • @Thorry84@feddit.nl
    link
    fedilink
    245 months ago

    Where I work you only pass the test if you report it to IT, otherwise it’s 3 hours of training with the rest of the idiots.

    • @bamboo
      link
      English
      175 months ago

      Does IT want useless reports? Because that’s how you get useless reports?

      • @Thorry84@feddit.nl
        link
        fedilink
        7
        edit-2
        5 months ago

        The IT people send out the phishing mail themselves as part of a test. It isn’t an actual phishing mail, just something made to look and act like one. In the end they have a report which people fell for it, which ignored it (or were ooo) and which reported it.

        Reporting is done via the report phishing feature in Outlook. For consumers it’s sent to Microsoft, but for businesses you can configure those reports to do what you want. It’s actually a really good feature and people should always use it.

        • @bamboo
          link
          English
          35 months ago

          Does your IT team tell you that they’re performing the test and to report, or is reporting phishing always constantly recommended. I’ve managed a small org ( <100 ) email server and we tried to have people report suspicious emails and it was so much noise and wasted so much time. Of course the CEO isn’t requesting you buy gift cards, what am I going to do about it. I’d say the money would be better spent on a better system rather than hope one human forwards it to another human.

          • @Thorry84@feddit.nl
            link
            fedilink
            3
            edit-2
            5 months ago

            They don’t tell us they are testing, it’s done at random. Reporting is policy, it needs to be done with every phishing mail that gets past the filters. It’s one of the big ways a company is vulnerable, an employee clicks on a link in a mail, opens something they shouldn’t and before you know it there’s been a databreach. I don’t think they are especially worried about the employee leaking his personal info, they are worried about targeted attacks and corporate espionage.

            I’m sure there are a lot of false positives. Even though I work in a technical company, we have plenty of people who aren’t as handy with tech. People get training regularly and if one person reports a lot of useless I’m sure they will train that person extra. I think for a lot of people except maybe sales something like 80% of all mail is internal. And the other part is probably 50% repeating automated mails. So the number of mails that could even be phishing are limited. It’s a mid sized company with about 1000 employees.

            • @bamboo
              link
              English
              25 months ago

              I see the benefit of reporting to catch false negatives of the filters, but in reality, if I received more than one report in a week or two, id consider a new system for scanning. A 20% false negative rate is pretty bad. Most emails should be easily identified, and I think it’s unreasonable for end users to check if the sender domain name is newly registered, has utf-8 characters which look like ASCII characters, etc. The metric for success shouldn’t be a high number of end users reporting phishing emails, but that seems to be what upper management wants to see, which just incentives less resources invested in better scanners with less than a 20% false negative rate.

              • Promethiel
                link
                fedilink
                25 months ago

                The metric for success shouldn’t be a high number of end users reporting phishing emails, but that seems to be what upper management wants to see, which just incentives less resources invested in better scanners with less than a 20% false negative rate.

                The eternal battle between the “oh we go by data backed metrics, much measured, I feel this is the best” executive suite and the poor saps beneath twirling the data backed signs going ignored until money or disaster strikes.

                Pity businesses aren’t formed from the bottom up; it’s like an octopus deciding not to listen to its arm brains until the shark has a bite of its head.

      • Black616Angel
        link
        fedilink
        15 months ago

        No, it’s better to get some useless reports than to get no reports at all because “somebody will surely report this”.

        Also people stay alert when punishment is an option.

          • Black616Angel
            link
            fedilink
            15 months ago

            But the alarms are different.

            In our company it works like that:

            Of you get a suspicious mail, you forward it to a specific address, where it lands in a backlog and is then looked at.

            It’s not an alarm, someone will ignore. It’s just another task on their list.

          • Black616Angel
            link
            fedilink
            15 months ago

            But the alarms are different.

            In our company it works like that:

            Of you get a suspicious mail, you forward it to a specific address, where it lands in a backlog and is then looked at.

            It’s not an alarm, someone will ignore. It’s just another task on their list.

          • Black616Angel
            link
            fedilink
            15 months ago

            But the alarms are different.

            In our company it works like that:

            Of you get a suspicious mail, you forward it to a specific address, where it lands in a backlog and is then looked at.

            It’s not an alarm, someone will ignore. It’s just another task on their list.

          • Black616Angel
            link
            fedilink
            15 months ago

            But the alarms are different.

            In our company it works like that:

            Of you get a suspicious mail, you forward it to a specific address, where it lands in a backlog and is then looked at.

            It’s not an alarm, someone will ignore. It’s just another task on their list.

        • @theneverfox@pawb.social
          link
          fedilink
          English
          15 months ago

          Justify their jobs? Their job is to set shit up, then be around at all times to help already frustrated people to do something they just forgot how to do today for no reason. And then, to politely listen as the person makes excuses to preserve their ego

          Security compliance? That’s handed down to them. If they had a hard on for cyber security, they could make 2-3x as much and no longer have to explain to people that they joined the wrong teams call

          I make a point to get to know the service staff. Chat with the custodian. Go to IT when you don’t have a problem… Get to know them a little as a person. Then, when you have a problem, you don’t have to make a ticket and wait for them to get to you. You already know them, and they feel respected as a person - they might not drop everything, but they’re going to bend the rules and quietly tell you how to navigate the system to get what you need as painlessly as possible

          They’ll also know if you’re an idiot or not already - they might know to trust you at your word, or they might know tech makes your eyes go glassy and hold your hand patiently… But either way, the respect makes them want to help you, and the preexisting relationship makes the whole experience less painful

          It is a shit job… It’s the overlap between being in the service industry and a tech worker. Almost all of them couldn’t make it in a more specialized role that would pay far, far more, and if you walk in during downtime half of them will be practicing their programming hoping to get a better job

  • @Boozilla@discuss.online
    link
    fedilink
    English
    195 months ago

    I created an inbox rule for these. The 3rd party phishing shame-and-train company my employer uses always has a certain domain in the email header (even though they always change the ‘from’ address). Has worked perfectly for over 6 months. I’m generally not dumb enough to click on them anyway. But anyone can have a bad day and/or get into a rush and make a mistake. And my boss is a sadistic prick who delights in making workers feel dumb. Yet I’m 100% sure he exempts himself from the phishing shit tests.

      • @TORFdot0@lemmy.world
        link
        fedilink
        English
        45 months ago

        The point isn’t to be so tricky to make it too hard for end users to catch it. It’s to train them to start looking at things such as senders domain and to report messages and avoid the link, etc.

  • @15liam20@lemmy.world
    link
    fedilink
    175 months ago

    My company appends a ‘think before you click’ header to external emails which are noticeably absent from the phishing tests.

    • @Chobbes@lemmy.world
      cake
      link
      fedilink
      55 months ago

      Mine always have the ReplyTo field set to the email of the senior security analyst, so I always say hi and tell them that maybe the higher ups need some training on how to not send sketchy as fuck emails that train people to click on phishing links.

  • @Zoboomafoo@slrpnk.net
    link
    fedilink
    125 months ago

    I eventually clicked the link in the test email out of curiosity, I got a nice popup telling me I fucked up

  • @lurch@sh.itjust.works
    link
    fedilink
    105 months ago

    Mine gives useless bonus points for forwarding the test email or an actual phishing mail to their special security scanner account.

    • @bamboo
      link
      English
      25 months ago

      Why not just have the security scanner before it hits an inbox?

      • @YoorWeb@lemmy.world
        link
        fedilink
        3
        edit-2
        5 months ago

        Filters will catch 90% of spam/phishing but there’s always something new that will slip through to inbox.

      • @lurch@sh.itjust.works
        link
        fedilink
        15 months ago

        There is, but if one gets through, they want us to forward it to this account that will be used to train, fine tune and improve the scanner for all mailboxes, as well as security training for employees.

        • @bamboo
          link
          English
          25 months ago

          That makes sense, I thought the security scanner was only triggered if someone forwarded an email after it landed in an inbox.

  • @Ainiriand@lemmy.world
    link
    fedilink
    95 months ago

    I am a software developer, I do not read emails. If something is so important that I should know about it someone will hit me up on ms teams or such.

  • @MrShankles@reddthat.com
    link
    fedilink
    75 months ago

    I always right-clicked for the “more info” (or whatever it was) with any suspicious email. It would look like a bunch of html code that I didn’t really understand, but buried in there would be a company name that was usually obvious, like “phishtesting.com” or some bullshit.

    I always had a 100% report rate, and always joked that I was waiting to get a prize for my accuracy. And obviously, also a joke to ever think I would get anything for it

  • Daniel F.
    link
    fedilink
    English
    15 months ago

    The best way to avoid scam emails is just to change your email account’s password to a random string, not save it, then log out. I’ve also shredded my SIM card so I can’t receive scam texts.