New email from [email protected]
New email from [email protected]
Alt text: Michael Scott Handshake meme. Managers text: "My company Congratulating me on avoiding a phishing test email". Michael Scott text: "Me, terminally behind on answering email."
"Let's also make our users follow really complex password requirements but have our password creation/change page be different from the actual login screen so they have a really hard time using a password manager"-dumbass IT department
Change your password every 30 days, and never reuse one, and don't use a password manager, and don't write it down anywhere, and...
The "Forgot password?" link is my new login process.
15 character minimum passwords that expire every 90 days and require MFA to remote in from home with 3 separate login sessions just to get to your PC, along with stripped down rights for everyone, even IS. The rights are so strict that if you wanted to, for instance, update a trusted application like Notepad++ because a recent exploit was found which would be a security concern, you can't use the auto-update feature of the application; you have to download it manually from their repository, and run it using a special admin account created for you that doesn't have an associated email address but also has a 90 day password requirement. But you wouldn't been able to use their repository 6 months ago because we block any IP address outside the US and their previous service was located in UK, so if you wanted to keep that piece of software up-to-date with security and vulnerability patches (which they've harped on a number of times before) you'd have to find alternative download services located in the US regardless of how shady.
I wish I was joking.
My current employer actually just changed our password policy to greatly extend the password expiration date. We have cranked up the password requirements a tad, every login has 2FA and permissions are locked down to the size of a gnats asshole. Users seem to like it better since they don't have to come up with a new password as often and we are telling ourselves it's harder to brute force.
My company sent me a fishing test email from a "[email protected]" email address. I sent it to our security department and asked if I would ever get legitimate emails from that address. They never responded except to say that I passed the phishing test, so I set up a filter to automatically forward emails from that to our security department with a message questioning its validity. Let's security tell me if emails are legit or not.
My normal method is I will hit the phishing attempt icon that IT Security added to our Outlook on anything that I did not request or sign up for.
I'm sure the IT Security person who saw all the "free gift card" emails had a great Christmas if they claimed all the gift cards emails they deem legit.
Where I work you only pass the test if you report it to IT, otherwise it's 3 hours of training with the rest of the idiots.
Does IT want useless reports? Because that's how you get useless reports?
The IT people send out the phishing mail themselves as part of a test. It isn't an actual phishing mail, just something made to look and act like one. In the end they have a report which people fell for it, which ignored it (or were ooo) and which reported it.
Reporting is done via the report phishing feature in Outlook. For consumers it's sent to Microsoft, but for businesses you can configure those reports to do what you want. It's actually a really good feature and people should always use it.
Damn, that's kinda harsh.
I created an inbox rule for these. The 3rd party phishing shame-and-train company my employer uses always has a certain domain in the email header (even though they always change the 'from' address). Has worked perfectly for over 6 months. I'm generally not dumb enough to click on them anyway. But anyone can have a bad day and/or get into a rush and make a mistake. And my boss is a sadistic prick who delights in making workers feel dumb. Yet I'm 100% sure he exempts himself from the phishing shit tests.
Knowbe4? That's who we use and their stuff is pedestrian
The point isn’t to be so tricky to make it too hard for end users to catch it. It’s to train them to start looking at things such as senders domain and to report messages and avoid the link, etc.
Using this too. But you have to report them, can't just filter and forget.
My company appends a 'think before you click' header to external emails which are noticeably absent from the phishing tests.
Mine always have the ReplyTo field set to the email of the senior security analyst, so I always say hi and tell them that maybe the higher ups need some training on how to not send sketchy as fuck emails that train people to click on phishing links.
Mine gives useless bonus points for forwarding the test email or an actual phishing mail to their special security scanner account.
Why not just have the security scanner before it hits an inbox?
Filters will catch 90% of spam/phishing but there's always something new that will slip through to inbox.
I just forward all of management's emails to the phishing account.
I am a software developer, I do not read emails. If something is so important that I should know about it someone will hit me up on ms teams or such.
Ohh, so you're the asshole.
No, I'm the productive one.
I always right-clicked for the "more info" (or whatever it was) with any suspicious email. It would look like a bunch of html code that I didn't really understand, but buried in there would be a company name that was usually obvious, like "phishtesting.com" or some bullshit.
I always had a 100% report rate, and always joked that I was waiting to get a prize for my accuracy. And obviously, also a joke to ever think I would get anything for it
The best way to avoid scam emails is just to change your email account's password to a random string, not save it, then log out. I've also shredded my SIM card so I can't receive scam texts.
Downvote for spelling.