Should Failing Phish Tests Be a Fireable Offense?

https://krebsonsecurity.com/2019/05/should-failing-phish-tests-be-a-fireable-offense/

by headalgorithm • 7 years ago

139 345 7 years ago

krebsonsecurity.com

busterarm3• 7 years ago

Repeat after me:

Everyone can be spearphished.

I mean it. Everyone.

naniwaduni• 7 years ago

Introducing an attack vector to get arbitrary people fired by policy can't possibly go wrong!

stcredzero4• 7 years ago

That should be an Internet rule: Don't set up any mechanism that puts severe power in the hands of anonymous strangers. It will get exploited!

stcredzero4• 7 years ago

My wife has 4 degrees, including a PhD from Stanford. She's working on another one. She got phished at work.

nradov5• 7 years ago

No I can't be spearphished. Prove me wrong.

umvi• 7 years ago

Since you are making the more extraordinary claim, you need to provide evidence that your computer usage practices are 100% infallible to sophisticated attacks against you by people who know a lot about you.

swizzler• 7 years ago

A favorite example of mine even if it's contrived: https://twitter.com/sc00bzt/status/730903007014076416

52-6F-624• 7 years ago

Oh that's funny!

josefresco2• 7 years ago

I have a client in the banking industry who performed these tests. Everyone failed. I'm not sure if they ran them again but there's a point where you need to sit someone down and explain how serious the situation is. If they still don't get it, you should probably fire them or transfer them to a department that isn't vulnerable.

dws• 7 years ago

It's possible to both get it and still be fooled.

Scoundreller16• 7 years ago

Did they run the tests without training first?

What’s the point?

If Security/IT is so dense that they see any value in testing before training, we’ve already identified a problem: culture or a “our employees are too smart for this issue”.

aianus• 7 years ago

Did they run the tests without training first? What’s the point?

How do you know if your training is working if you have no baseline?

Endy4• 7 years ago

How hard is it to make people understand what a business email should or shouldn't include? If you're being asked for data by someone you don't know, either ask a manager or someone connected to the account in question.

Are people really so gullible & trusting?

josefresco2• 7 years ago

If you're being asked for data by someone you don't know

That's not how spear phishing or even phishing works. The email looks like it came from a fellow employee/boss/trusted party.

Endy4• 7 years ago

What about the sending and reply-to address? If the account is actually compromised at a system level, that is an IT issue. Again, are people so trusting that they don't check when asked for confidential data?

nradov5• 7 years ago

That's only true if you have a shitty enterprise email system. On a proper system such spear phishing attempts are blocked before reaching end users, or at least immediately obvious to anyone paying attention.

jquinby• 7 years ago

What about an email from someone you know (coworker, relative) via a spoofed or compromised account?

Endy4• 7 years ago

I learned to look at reply-to back when I used Juno & Netscape Communicator. Heck, Communicator used to warn you if reply-to differed from the displayed name.

xvector• 7 years ago

Are people really so gullible & trusting?

Yes, and it is not a “bad” thing outside the niche of security I think. We should all hope to live a life where we can implicitly trust other human beings.

stcredzero4• 7 years ago

In small town America in the 70's and 80's of my childhood, life was pretty darn close to this.

galangalalgol• 7 years ago

The tests I have seen are more like a macro enabled office document attatched to an email that says it is from an address actually on the corporate email server. And it has a line like "review my schedule update, a week less for test creation is fine right?". Except I don't work with the sender and the corporate firewall as marked as having actually been sent from outside.

oceanghost3• 7 years ago

Have you ever worked for a big company? (Think several US offices, half a dozen European and Asian offices, 500m in revenue).

Someone forwards me an e-mail from our Dutch office that says, essentially, "The world is burning down, we are boarding a plane in a couple of hours to go to IFA (show), and we don't have the latest copy of product X to demo for customers."

I do builds by hand of this product because I can't get resources allocated to automate it

I have never heard of any of these people before. I reply asking, "I am sure I can accommodate you, but, Who are you and why I haven't been told about this before now?"

To my shock, the guy replies, "I'm the European Vice President for product X, we didn't ask before now because it has never been a problem in the past. Who are you?"

I reply, "I'm the only person in the entire world with the encryption keys to provision the product, and that has to be done on one single computer in Santa Ana. It's only a fluke that I am here today-- my car wouldn't start this morning, and I had planned to take the day off to fix it, and then by some miracle an hour later it started. That's why it's important to know about things ahead of time."

That's what working at a big organization is like, you interact with people who don't know all the time. And frankly, nobody is ever allocated time for "security" in their schedule. My dance card at that company was scheduled for 8 hours of development a day, no e-mail answering, no security, no time to do the build system. No time for meetings. Nothing.

0xffff210• 7 years ago

Maybe that's how it is at your big organization. I'm sure glad my big organization is different.

ben5092• 7 years ago

I'm the only person in the entire world with the encryption keys to provision the product

The chaos that surrounds you, the facts that astound you, at last your number has found you, your bus number is one.

nucleardog• 7 years ago

If you're being asked for data by someone you don't know, either ask a manager or someone connected to the account in question.

Most cases I've seen of successful (or nearly successful) spearphishing would have been solved by someone picking up a phone and calling their co-worker.

"I know you sent me an email, but can you just explain again why you want me to buy $1000 in iTunes gift cards and email them to you?"

"I got that invoice you sent. Just wanted to confirm the amounts -- $50k wire transfer?"

Nasrudith• 7 years ago

I suspect hiring practices and company culture may be selecting for gullability either accidentally or deliberately in many cases (cynically the gullible are easier to motivate cheaply). Like how "being a team player" is used to refer to willingness to work unpaid overtime as opposed to actual ability to cooperate.

If they value "responsiveness to their authority over procedure" then people will send the entire financial records to "the CEO" for fear of getting fired otherwise.

ben5092• 7 years ago

The trouble is that people have a ton of intuitive buttons to push, and being intuitive they're not usually aware of them. (In straight cons, the buttons are often emotional, which is why the term con comes from building "confidence." Phishing is more faking authenticity than appealing to emotion.)

Skepticism and rational thinking require effort, and thus as people are rushed or tired, those are the first defenses to fail. You can train to recognize patterns of phishing, but learning those patterns takes time, repetition and effort.

All that a good phish requires is finding the right buttons to push on the right person, and they have many potential victims to press them on, and little to no consequence to getting it wrong.

So, the answer is people are not particularly gullible, but the weak links are a constantly changing, largely unknown dynamic and the phishers can hammer at all of them simultaneously until they get through.

mc32• 7 years ago

Nope. Of course not. These opportunistic campaigns use inherent human weaknesses to lure and snare suspecting and unsuspecting users.

Now, if someone is told that official policy states you must only use approved devices and services and you violate that and that introduces additional weaknesses, then yes. But that’s different.

I mean phishing experts in active campaigns get phished. So, regular Jane and Joe? ‘Course not.

donio• 7 years ago

Yes, the security team should be fired since they failed in the educational aspects of their job.

toomuchtodo• 7 years ago

We still issue speeding tickets instead of firing everyone at the DMV.

Educate all you want; no consequences, no behavior change. Incentives matter. Employee opsec metrics should be a part of corporate cybersecurity insurance pricing IMHO.

jawns• 7 years ago

This is a good point, and I think there are parallels to other areas of the industry.

For instance, let's say I'm a junior developer and I'm told that merging code that fails a suite of unit tests is a serious offense.

If I one day forget to run the test suite and merge code that breaks stuff ... it might be my fault at an acute level.

But at an organizational level, someone should be saying, "If it's that important to not merge code that breaks tests ... then we should change our process so you _cannot_ merge code until all tests have passed."

And if nobody gets faulted at the organizational level, then the junior dev is really just a scapegoat.

Trisell• 7 years ago

Rohyt Belani, CEO of Leesburg, Va.-based security firm Cofense (formerly PhishMe), said anti-phishing education campaigns that employ strongly negative consequences for employees who repeatedly fall for phishing tests usually create tension and distrust between employees and the company’s security team.

This is the key. If you think security teams aren’t hated enough for having to change your password every 90 days. Just wait until their “games” are the reason for people getting fired. This is a guaranteed way to get your users to not only not want to help you. But actively work against you. And if enough people scream the C ring will eventually listen. And I don’t think the security team will win.

Consultant324524• 7 years ago

When a new phishing test goes out everyone in my department announces to everyone else to watch out for it. So it's a bonding experience of the non-security people against the security people.

smelendez• 7 years ago

That seems okay though, since it's also behavior you'd want if real phishing emails were coming in.

4ntonius8lock• 7 years ago

It's silly to do it inhouse.

It creates distrust.

That is why you pay consultants. They send out the phishing test, and hopefully regular people bond with the security people in an effort to pass it.

I mean, after all, security and regular people in the company should want the same thing (company success... which implies not giving away things to phishing probes)

freehunter3• 7 years ago

On the other hand, all the security team needs to do is point to the number of billion-dollar breaches that have happened due to phishing. If phishing tests are a game, then so are DR tests, so are code reviews, so is the QA department. If phishing tests are a game, then so are your yearly performance reviews, or showing up to work on time, or meeting your deadlines.

Not destroying the company through your own negligence should be basic standard practice. Repeatedly failing a phishing test even when given proper security education (like PhishMe provides) is negligence that can destroy an entire company.

I worked in security at a company where the IT security department didn't report up the IT chain but was under HR alongside the Internal Audit department. Enforcing policy and holding people accountable were fundamental expectations of our managers all the way up, no different than someone repeatedly harassing a coworker or watching porn at work.

perl4ever2• 7 years ago

"Not destroying the company through your own negligence should be basic standard practice. Repeatedly failing a phishing test even when given proper security education (like PhishMe provides) is negligence that can destroy an entire company."

The issue is that people are trained and required to ignore warning signs most of the time, so it is impossible to crack down too harshly.

Employees by definition do not really care about destroying the company, because they do not own it and can walk away if they like. So the company does not have unlimited leverage over them.

Benjammer2• 7 years ago

all the security team needs to do is point to the number of billion-dollar breaches that have happened due to phishing

A problem here is that a company whose leadership is receptive to your argument would probably already have mandated some form of security/phishing training. The ones who are likely to fall victim to these problems are the same types who do not plan for this stuff to begin with, and also would not be receptive to your hypothetical argument, imo. (e.g. "I don't have time for thought exercises, how many performance bugs have you fixed this week!?")

The path to victory is far more often along the lines of teaching your leadership to care for themselves about security, rather than trying to beat them over the head with heavy-handed hypotheticals of doom and gloom if they don't listen to you and do what you say. They need to feel it in their bones themselves. Otherwise you're never going to get cultural buy-in from the rest of the organization.

megaremote3• 7 years ago

So, do the security guys get fired when they misconfigure a firewall or give the wrong settings for a database?

orthoxerox• 7 years ago

90 days? Our security team forces us to change every personal password every month!

greedo5• 7 years ago

Point them to NIST's new guidance on mandatory password changes.

Shivetya• 7 years ago

Well lest we forget that some companies only pursue those who management at some level wants out. Many times negative consequence campaigns are just used to hide real intent.

then throw in all the people excluded from being judged and it can affect morale to where people get ambivalent about other security issues.

c3534l• 7 years ago

I'm capable of not clicking on random links in email. I'm not cognitively capable of remembering dozens of passwords and then "forgetting" them (i.e. memorizing that the password you previously memorized is not the password any more). And then throw in the fact that schemes like that also don't work.

j0057• 7 years ago

MFA as provided FIDO/U2F seems like a much more sensible approach, that doesn't break down on even a momentary lapse in vigilance.

dsfyu404ed2• 7 years ago

I worked for a defense contractor that had a 3 strikes policy for security violations. Failing the phishing emails was a strike. Other breaches of security policy (like getting caught letting someone tailgate you in) could be strikes too. You got fired at 3. Nobody thought this was unreasonable. Part of your job when you work in defense or finance is giving a sufficient number of fucks about things that people in other industries don't have to give many fucks about, like security. If you don't care enough about security that you click on obvious phishing emails then you're not doing your job. Don't do your job and get fired.

They also did have a reporting system. Presumably you wouldn't get a strike if you clicked and reported. People who reported "legitimate" phishing attempts were rewarded. Spear phishing is a totally different game and nobody in their right mind would fail people for clicking on a (well crafted) spear phishing email.

jasonhansel• 7 years ago

This is a great idea for defense contractors, and (probably) an exceptionally draconian idea for most other workplaces.

eindiran• 7 years ago

I agree that a very strict version of this is too draconian for most workplaces, but depending on the person's role and how many times they've failed a phish test I think it's reasonable to have consequences. For positions where getting phished would be disastrous, something along the lines of a warning or training after the first and second strikes then firing after the third doesn't strike me as exceptionally draconian.

LinuxBender2• 7 years ago

I do not agree. This should also be implemented in financial institutions and any company that has access to overly sensitive information, especially that which you can not easily change or that would put your family at risk of harm.

I would add in my proposal that if a percentage of employees under a director fall for it, the director gets let go. If a number of directors are let go, the C-Level is let go and so on.

the_jeremy• 7 years ago

Seagate had all of its employees W2s phished because someone in HR messed up badly. If you have access to PII or other confidential information, phishing is a big deal.

Consultant324524• 7 years ago

I work at a financial company and we have a similar policy around phishing email. Embarrassingly, I failed this once and then created an email rule which filters out the fake Phish. No idea if it gets real Phish.

thrwwwy29may• 7 years ago

Embarrassingly, I failed this once and then created an email rule which filters out the fake Phish.

how did it get you, if you don't mind sharing? It seems if someone who works in IT (guessing you do) and is very careful fails it, this is an impossibly high standard to meet.

curious how they got you.

LaGrange2• 7 years ago

...and now we see why such policies are bad, and it's even covered in the article: while people falling for phishing are bad, what's even worse is when they fall for it and don't report. Creating a culture where the security is the enemy is _not_ good.

I mean, sure, if it's 20 times, we're getting into outrageous territory and you have reasons to suspect employee is trolling you. But other than that, the reality is that your employees _will_ get phished eventually. Reduce the risk and work on reducing the harm caused when it happens, instead of antagonising your workforce.

Edit: also, if you could just "filter out" the test means that the tests were about as good as most corporate "compliance" training is. Just as the firings, it feels designed more to coddle the C-levels than actually achieve anything.

ce4• 7 years ago

It should be appealable. I see at least two problems with such a phishing test:

a) Some test phishing urls include the plaintext mail address of the employee. Easy to retaliate against someone you don't like.

b) Does the phishing test service detect if the link is accessed via a sandboxed env?

0xffff210• 7 years ago

Does the phishing test service detect if the link is accessed via a sandboxed env?

Does it really matter? I used to play these games with my org's absurdly obvious phishing trainers, but the truth is it's not my job to determine whether an apparent phishing email is genuine or not. If you know that getting phished is a fireable offense, then just don't access the links, obvious fake or not.

Kalium9• 7 years ago

b) Does the phishing test service detect if the link is accessed via a sandboxed env?

In any company likely to be doing phishing testing internally, there are two kinds of people who might try this. One is the infosec group, which isn't going to do this because they're running the test. The other is engineers who think they're clever and are equipped to fsck around with things.

The former are professionals. The latter are dangerous and not actually an exception. The frequency with which their confidence is justified approaches zero and in the vast majority of shops simply not worth the time it takes to contemplate.

baroffoos2• 7 years ago

The env it was accessed in shouldn't matter too much. Simply clicking on a link is a fairly small risk. Not zero risk but unlikely to be an issue. The real issue is when the link you clicked on asks you for a password and you type it in. You should only fail the test for giving a password.

mason553• 7 years ago

I actually like the idea of having consequences for allowing tailgating, assuming the company cares about it. Maybe not firing, at least right away, or if you get tricked/someone sneaks in behind you, but put some teeth in the policy and actually enforce it.

If the company just says "don't do it" there is still social pressure to be polite and not slam the door in someone's face. But if there are consequences that everyone knows about then no one is going to begrudge you if you tell them they have to swipe their own way in.

Heck, put up signs that say "allowing tailgating is a serious offense" so that visitors are aware as well.

newsoul20192• 7 years ago

If you really don't want tailgating, put in a man trap.

wang_li• 7 years ago

Are you prepared to pay your employees a significant premium for the requirement that they engage in fisticuffs with random strangers who may try to tailgate into the building?

Tailgating is a problem for your physical security staff, not your run of the mill white collar employee.

52-6F-624• 7 years ago

I rather like my buildings' set up for this—

We have passcarded doors and then inside we have gates like many subway stations do that are timed only long enough for one person to pass through.

So I can hold the door open for someone on the way in—especially if they have their badge out— but there's nothing I can do about those giant plexi gates once inside. They have to swipe.

jethro_tell• 7 years ago

The company has a one strike policy for letting someone use your badge, or letting someone tailgate.

They also have people who go out and try to tailgate, and say they left their badge on the other side of the door and ask if you can badge them in, or let them borrow your badge to get theirs. If you help, they walk in and get security and HR and you're done.

closeparen6• 7 years ago

You can wave any object at the sensor. Maybe an unauthorized tag will yield a different beep or make the light flash a different color. Maybe the person in front of you will be in a position to see the light on the reader, maybe they'll notice, and maybe they'll consider it odd. Getting that far, and then actually deciding to challenge you or report it, is a vanishingly small chance.

There is no point in badging an unlocked door, or in expecting people to do so. You have to actually close it between entries. This is a physically and socially ridiculous thing to do with traditional doors; if it's what you want, you need a turnstile.

chrismcb3• 7 years ago

If you don't want tailgaters then hire bouncer security types to stop people. It isn't my job to put my life on the line.

King-Aaron• 7 years ago

In my building, we have a similar tailgating policy, and its quite strict. A sign states that it's a federal offense and that police will be contacted.

At first I thought it was weird, but since being here I've noticed more and more unmarked and federal police vehicles parked downstairs, and several offices/floors that are unlabeled and used mainly by those guys.

I'm guessing there's some kind of diplomatic etc services that go on here which not everyone's privy to.

wil4214• 7 years ago

I had to take a security training class because I failed to report a phishing attempt. Didn’t click the link and likely ignored the email altogether. My boss was confused why they contacted him. I don’t work there anymore.

mjevans• 7 years ago

They failed you for a negative result to such a test?

I agree, this should only be for 'positive' results (getting hooked).

barbecue_sauce2• 7 years ago

Would it have counted as failure if you simply had never opened the e-mail?

m463• 7 years ago

I think it's reasonable, but there should also be reasonable common-sense support for these policies.

"No tailgating" can be supported through decent vetted entrances and exits.

"No phishing" could have mailserver and mail client support to properly flag the origin of emails and/or enforce "no remote loading" or "restrict html" or "check attachments" sorts of things

CydeWeys• 7 years ago

If tailgating is that big of a deal, especially for the defense industry, then they need to install man traps at the entrances. Make tailgating physically impossible. It's unreasonable to expect, say, a smaller female employee to stop a larger male who she only realizes is tailgating her after she's already swiped her badge. If physical employee is that important, install physical security or have guards. Plenty of important facilities have both.

SilasX3• 7 years ago

I don't think any company's policy requires every employee to physically stop the tailgater. It would be enough that she e.g. alert security to the situation.

chrismcb3• 7 years ago

It is absolutely unreasonable to get fired by putting your life in danger to stop trailgaters. There are essentially three types of tailgaters, people who belong there, tourists, and nefarious across. People who belong there are just getting lazy, but it is OK. Tourists you can stop (these are people who might be guests, or are just curious) but these people aren't bad people, and most lonely wing do any harm. Then there are the nefarioys types, the criminals... The ones who are there for a bad reason, and I'm supposed to stop them?

marcinzm• 7 years ago

The ones who are there for a bad reason, and I'm supposed to stop them?

You can contact security, presumably a company with such a policy has 24/7 on site security.

bronco21016• 7 years ago

Say what you want about air travel security but the TSA has figured some stuff out. For all of the behind the scenes employees, working in what’s known as the SIDA (security identification display are), there are protocols that must be followed. Most are what seems like security common sense but to really drive the point home there are stiff financial penalties for not following them. Typically the employer will pick up the bill but ring up a couple of them and you better start looking for a new job because you’re definitely going to get fired.

I think some kind of strike system is completely reasonable and if you’re working on sensitive information or systems then phishing most definitely needs to count as a strike.

megaremote3• 7 years ago

Nobody thought this was unreasonable.

How could you ever possibly know that?

JamesBarney• 7 years ago

I like the three strikes rule. Sometimes it just slips through.

I got caught by a phishing link once because I had just gotten off the phone with a co-worker John and got an email 5 minutes later that said "hey James, it's John". Didn't even think twice about clicking it.

britch2• 7 years ago

I think it's very case by case. On first fail of a phishing test, absolutely not. They should have phishing explained to them again, maybe in a more personal setting (instead of educational video/talk).

It's definitely true that anyone can be spearphished or can fall for a sophisticated enough phishing scheme, but if someone is continually failing the most basic phishing tests (responding to random emails asking for your password for example) I think that's grounds for firing.

It's akin to locking up after you leave. Is it a fireable offence to fail to lock up the office when you leave? Probably not the first time. But if you never lock the door, at some point it becomes a liability. Sure a professional could break in even if you lock the front door, but it's not like locking up is pointless.

jerf• 7 years ago

Proportional to the degree of damage that can be done by the employee in question... yes, absolutely. If you have the responsibility and authority to disburse millions of dollars to a random bank account number, then you've got a high degree of responsibility not to be spear-phished, and it would be a disqualification if you are unable to resist it.

On the other hand, firing a front-line call center employee because they failed the spear-phishing tests is fairly pointless and more damaging than helpful.

Where exactly the line falls would be up to the business and like so many things, involves too many factors to be reasonable to discuss here. With the typical concentrations of power and authority in a business, it's only going to be the minority of employees that would be faced with termination for this problem, because only a minority will have the power to do significant damage to the business in general.

I think it's not too difficult to think that the article is mostly talking about the situations where it isn't proportional to the degree of damage that can be done by the employee.

agurk6• 7 years ago

A few years ago I received one of these at work, before I even knew they were a thing. I would have been very annoyed if they'd taken any action against me for following the link in it.

The email itself looked like a standard spam email, but the link was really weird, having a few tokens as part of a query string. Normally fishing emails have simple URLs in them.

So I did the obvious thing of opening the link in a fresh, zero data, locked-down VM just to see where it would take me.

I got the message that I was an idiot, and my company also was notified that I'm clueless about information security.

I can only imagine how difficult it might be to explain to someone what I had done, and why I probably shouldn't have to go on some tedious training course let alone be fired. Luckily all I saw was an increase in the number of these emails I received.

wmf• 7 years ago

Often the phishing training says "do not investigate yourself" but maybe your company missed that part.

agurk6• 7 years ago

There's was the general "don't follow links in unknown emails" but nothing about what to do if you're sure it's a bad email but terminally curious.

As far as I could tell nothing bad could happen (even JS was off in the browser I used to open it) when I followed the link, but is there something I should be aware of?

maxk422• 7 years ago

I'm a tech professional and security is a regular part of my jobs. At one point -- while contracting for a Fortune 500 client that shall remain unnamed -- I received an email that was quite clearly phishing. Curious as to what the payload was and whether it was worth reporting, I fired up lynx and followed the link in the email from the command line.

I was promptly informed that I had failed the test and I would be receiving a formal reprimand.

Did that make the company more secure?

Sohcahtoa822• 7 years ago

Did you alter the URL at all? Every phishing test campaign I've seen has a URL in the form of like http://totallylegit.your-company.com/somePath/login?id=12345.... I'd change the id= to some other value before testing to mess with their tracking.

grimjack00• 7 years ago

Unless you're certain how that ID is generated and/or linked to your identity, you've probably just put someone else at your company on the naughty list.

dboat• 7 years ago

Presumably you were able to explain your case and have the reprimand expunged from your record. As long as they are reasonable in that way I don't think occasionally testing the people handling sensitive data is a bad idea.

dvtrn2• 7 years ago

Should it be expunged though? They've indicated they were aware it was quite clearly a phishing attempt, but they still accessed the link. If the test was to see if a user would try accessing the link, then this user failed the test. Why should that be expunged?

Curiosity shouldn't preclude security, and intent shouldn't preclude policy if the operator operated knowingly.

This isn't to attack maxk42, but to engage the question head on.

overgard8• 7 years ago

I think a better idea for the person involved is to work at a company that isn't run by self-serious bureaucrats.

ryanjshaw• 7 years ago

Can't speak to whether a reprimand is warranted or not and I think many here will disagree, but unless your job is investigating phishing, you shouldn't do this because you ARE ultimately putting the corporate network at risk unnecessarily - what if it was a real link and happened to exploit a zero day on your box? Management wouldn't accept your reasoning for following the link I suspect.

Dylan168074• 7 years ago

The risk of hitting an exploit on the command line, especially with something like wget, is enough orders of magnitude lower that I think it falls under acceptable. The standard cannot be zero risk because that's impossible. Even shutting off the internet link doesn't get you all the way to zero.

jsty• 7 years ago

Considering that from what I recall Lynx doesn't execute javascript, it would have to be one esoteric zero-day

MisterTea• 7 years ago

I doubt most if not all exploits would work in lynx/links.

But your point is spot on, don't take it upon yourself to do things that aren't in your job description. Otherwise you become that person who takes it upon themselves to "fix" things and makes the problem worse for the people responsible for fixing things.

maxk422• 7 years ago

My job is not investigating phishing but security is everyone's job. Reporting what was obviously a targeted phishing attack to the people who do investigate phishing is a basic expectation. Now before you try to tell me "well you should've forwarded the email and been done with it" those guys are going to be pissed as fuck if I pass along every spam link trying to sell me boner pills, so I've got a duty to make sure it's a credible threat. As somebody who knows how to safely investigate such a link and did exactly that it was ridiculous to be penalized. Security (albeit not for email) is a part of my job. I don't think people should be trained not to use their brains when it comes to security threats. If people used their brains more often phishing would hardly be a problem to begin with.

dearrifling2• 7 years ago

Counting opening a mail as failing is ridiculous. A a phising test should only count captured logins.

Scoundreller16• 7 years ago

When I see one of these, I actually do go onto my Corp iPhone to delete the email instead of Outlook/Windows.

It may not be a perfect approach since we do use it for MFA...

Kalium9• 7 years ago

Following a link can readily enough expose someone to risks. Phishing isn't always just about entering logins.

alkonaut4• 7 years ago

If I’m curious I’ll open the link off the company network. Easiest way I can think of is just opening with a browser on my private iPhone while on a 4G connection.

chelmzy• 7 years ago

It would still trigger the fail. Typically the link contains an identifier and the landing page is hosted on a public facing web server.

goguy• 7 years ago

The fact you visited the link would let them know that company x has an current employee named y.

Whilst that information might not be sensitive it could be used at a later date to extract sensitive company information.

thrower123• 7 years ago

They could also look you up on LinkedIn.

There should be a line drawn between real security-conscious workplaces, and the kind of self-important chickenshit places that seem to delight in playing games and harassing their employees with this kind of thing.

megaremote3• 7 years ago

Yes, it does. You should have been let go.

overgard8• 7 years ago

Really, you'd fire every engineer that shows an ounce of curiosity? I'm glad I don't work where you work.

stcredzero4• 7 years ago

Is someone trying to apply AI and Deep Learning to phishing attacks? One of the things which PG noted in "A Plan for Spam" back in the day, was that the Bayes classifier found markers of Spam he never would have thought of.

http://www.paulgraham.com/spam.html

If Phishers are concentrating on fooling human beings in the same way that spammers were back in the day, they might be vulnerable to such techniques.

nineteen999• 7 years ago

That is such a fascinating document. Back in late 2002 or early 2003 I did an implementation of the algorithm in that document in C (because I didn't understand Lisp) with the help of a more senior programmer at my company.

Once my implementation started to work I was really amazed how such a simple algorithm could be so successful.

jessriedel4• 7 years ago

Honest question: why do so many workplace penalties come with only two levels of punishment?: words ("reprimand") and getting fired. This would be like only having speeding tickets and the death penalty in normal law. Losing part of your bonus for the year would certainly sting enough to provide a disincentive without having to fire anyone.

chessturk2• 7 years ago

Many people don't get a bonus. If you have no benefits, an hourly wage, and no path for advancement, the only thing they can do is whine or fire you.

jessriedel4• 7 years ago

Sure, that's an explanation for those sorts of jobs, but they aren't usually a target of phishing attempts.

leiroigh3• 7 years ago

Phish tests need to be fair to people who actually understand something about security.

"Opening an email" is not actually an issue (spearphishers that sit on drive-by 0-days in current browsers or email programs are not a threat model that most orgs can possibly defend against). Opening attachements is hard to measure and again needs context: What kind of software and sandbox was the attachement opened with? Attackers using some ancient forever-day word processor exploit is realistic. Attackers sitting on fully patched VM outbreaks is unrealistic. If the used VM has unimpeded network access, then the attacker needs no VM outbreak. If the target opens a phish link in a current browser, but then refuses to enter valid credentials (because user is wary), then the user can be argued to have passed the phish test.

If you make failure fireable, then you need to demonstrate that the victim was actually successfully phished.

If failure requires remedial training, then you can afford a high false positive rate: Clueless victims learn not to click on links, and sophisticated "victims" get to talk with a security person about why their action was dangerous or harmless, and in accordance or in violation of policy.

technion• 7 years ago

This definitely needs to be considered. I open WSL and use curl on suspicious looking email links. I've been logged as doing so before. I'd hate for that log to actually go somewhere significant.

Kalium9• 7 years ago

It might be worth considering carefully how safe the practice of opening essentially random email links might be. Are you opening the links with a full suite of forensic measures in place, or are you dropping curl $URL into your terminal on your workstation? It looks like WSL isn't exactly a sandbox. It does seem to already be used by some malware: https://research.checkpoint.com/beware-bashware-new-method-m...

In a world with drive-by exploits and where opening a link leaks information, it perhaps could be considered unsafe to open essentially random links from emails. I've definitely worked with developers who seem to believe that curl is magical and inures them against every possible attack.

Curiosity is a wonderful thing! It's just sometimes it can be dangerous to a person and to the people around them. It might not be a bad thing for people to learn a smidge of caution.

sct202• 7 years ago

I think it depends on the level of trust that you are given in your position.

I got reamed on another forum for saying someone shouldn't be allowed in a certain role, after they sent $1 million to a fake bank account to someone posing as a supplier. But if your work place doesn't have controls in place to prevent that, it's part of your job to be that control and take additional steps to protect yourself and your employer.

kasey_junk• 7 years ago

Didn't google effectively prove that the only way to prevent phishing was u2f?

http://fc16.ifca.ai/preproceedings/25_Lang.pdf

rdiddly• 7 years ago

As an employee education campaign, my last Bigco employer started sending out their OWN phishing emails, and if you clicked a link in one of them, you'd be taken to a page explaining how you got tricked and what not to do. Pretty good way of targeting the message to those who need it most.

0xffff210• 7 years ago

That's pretty standard. The problem is that they don't actually attempt to phish you. These emails are only good if your security model is that you can't click untrusted links (i.e. you want to defend against browser 0-days). If that's the security model, why do I even have a browser on my computer? In fact, my organization's policy says that I'm allowed to use my work computer for personal business (like reading a HN article while I'm taking a break)... If they have no problem with me browsing reasonable parts of the public internet, they have no business failing me on a phishing test that never even asks for any credentials.

morrbo• 7 years ago

I see this a lot as a security guy. There has to be a healthy medium. Users can be fired, sure, but this should be a last resort. It's not really fair to say "you're fired" when you don't have DKIM/SPF/DMARC, you haven't tagged external emails as such, you haven't provided here awareness training, you have provided training but not in a gradual form (ie. From Nigerian prince emails right the way through to sophisticated attacks), you're not providing outbound filtering, educational resources or a reporting tool, you've not registered similar domain names or <my company>. otherTLD, sandboxing, AV...

Users know what phishing is, even the most naive of them. You need to do your darndest to make sure nothing gets in to your network first off. If people are repeat offenders then you have to chat with them first off and figure out what's going on . If they're being intentionally obtuse - clicking emails to see what happens even if they know it is phishing - then look into firing them, otherwise just act like you're on the same team, provide them with education but not overwhelming amounts, and it s eems to work has been my experience anyway

colechristensen• 7 years ago

Your organization becomes more secure if people aren't afraid of revealing their mistakes.

Seriously, you should give people who fail phishing tests cupcakes and additional future phishing tests. If there is a continued failure or inability to learn then there is a problem to be fixed perhaps with firing.

Cultures of fear breed disaster.

freehunter3• 7 years ago

give people who fail phishing tests... additional future phishing tests

This usually happens, especially if they're using something like PhishMe. If you fail the phishing test, you're immediately told you were tricked, and scheduled for mandatory training within a few days. After you complete the training you're put on a re-targeting list.

What we're talking about isn't firing someone for making a mistake. It's firing someone for gross negligence over and over again even when given proper training and incentives. At some point it becomes clear that the employee is a danger to the company. If they're that careless with their emails even after getting caught and going through training, what else are they neglecting to do? And who might be injured/killed because they don't care?

msla• 7 years ago

OK, if you do that, I won't open any links in any emails from itdepartment@example.com, where itdepartment@example.com is the group email of my company's IT department.

I may or may not open any emails from that address period, depending on how paranoid I'm feeling.

Or... and catch me if I'm talking crazy here... or do you want to fix the email software so I can trust that only the IT department can send me emails from itdepartment@example.com which actually make it through the firewall and email filtering software and internal email security policy to reach my email account?

scarmig• 7 years ago

Targeted phishing always eventually works, at scale.

If successful phishing leads to significant data breaches, that's a technical/systemic problem, not a personal one.

bjt2n3904• 7 years ago

I think I'm a pretty technical guy. I'm fairly certain if my job was more dependent on email, I'd get phished eventually. If the IT department hasn't made a move towards using 2FA, it doesn't seem right to punish employees with termination.

andymoe• 7 years ago

Honestly, if these make it to users it’s a sign IT issues. Training users is good too obviously.

siffland• 7 years ago

I was just talking to a coworker yesterday and at his previous job part of his security was to go out to the employee parking lot and dump thumbdrives, if they were plugged into the corporate network they would send a message to the security department on the terminal and user account. I actually said to him, no one would be stupid enough to do that, he told me they did this monthly and at least 2 to 3 people would get caught.

He said employees had training and still failed. No one got fired for it though.

alkonaut4• 7 years ago

It’s like people don’t have (private) computers anymore. If you get caught doing that, or watching animal porn on your company laptop or whatever, the problem isn’t poor IT training, the problem is that you should have bought your own computer! How are people so eager to look at the thumb drive that they can’t wait until they get home?

Scoundreller16• 7 years ago

I could only imagine how bad things would be if most people didn’t have their own smartphones.

I think having a “guest” wifi discourages employees from using visiting random streaming websites on their work computers.

microcolonel• 7 years ago

Depends on what you're doing, but if your employees are dangerously gullible, of course firing them should be on the table if they (especially repeatedly) exercise that gullibility, and it is not feasible to give them tools to mitigate that risk (like PGP, though that's not perfect either).

My general approach is to create computing environments which make it generally impossible to send/receive general communications, and access sensitive information (or the web), at the same time on the same machine. The communication channels available to an agent while accessing a customer file are heavily sanitized, and the environment does not allow for opening links; images are transcoded in fresh containers on a remote machine with no general access to the database or the internet.

The real question is: do many businesses understand the risks well enough to make that determination well?

BeetleB3• 7 years ago

My company uses similar tests - you get a random email and if you click on the link you're required to take some training. One of the things they emphasize is to ensure the actual URL seems legitimate, or is pointing to a company domain if the email claims to be from within the company. Ditto for the From field.

Recently there were reports of an active shooter on site. Everyone got email alerts about it. Many (most?) employees ignored the alert because the From address was an unknown external domain. Fortunately there wasn't an active shooter (although the person who was arrested was armed).

And then the company sent out an email asking us not to ignore those types of emails even if it appears to be a phishing attempt.

I think from now on, just for the heck of it, I'll click on the links but modify some of the characters in the URL. Hopefully someone else in my/some company will be notified that they need training.

istandintraffic• 7 years ago

We definitely do not enforce tailgating enough at DoD. I find it best to stand aside at let people pass before I swipe. The funny thing is that they have security that ensures there is ample space between us, but still some jackhole wants to bend the rules because they are special.

bravoetch• 7 years ago

Firing people for this would leave the entire company in a state of fear. Have you seen those sci-fi dystopias where a script or AI unfairly decides the fate of people...?

ARandomerDude2• 7 years ago

In my office we can get into trouble for this. However, they always send a magic header in the email to get through the firewall. My solution: filter out emails with the header.

Scoundreller16• 7 years ago

What if a spearphisher is watching out for the test emails on one account and we lose the magic headers that bypass the firewall? What then???

ARandomerDude2• 7 years ago

I don't disagree. But that's not my department and I'm not high enough up the chain for my opinion to matter.

faissaloo• 7 years ago

That's pretty draconian.

bediger4000• 7 years ago

I might consider this - if my employer gave me tools to deal with looking at email headers, etc etc etc. That means iff I have to use Outlook/Exchange, and nobody will tell me what the external SMTP server IP address is (and other information) this is unreasonable.

I've had two different large, corporate employers do the phishing training thing. I've failed occasionally at both of them. You can make a phish as close to indistinguishable from a legit email as you want.

In my experience these "phish-your-employees" programs have 2 side effects, both possibly unwanted:

1. Reluctance to even look in Outlook for fear of getting a drive-by. I know these haven't shown up in a while, but Outlook is a strange beast. That is, I'm just not going to look for, or even open, emails. 2. Enthusiastic reporting of false positives. After getting burned by a decent phish, I reported a few legit emails, including one that had a salutation of "Dear Joe User:" or something equally generic and stupid, but was a genuine email. There's sort of a Poe's Law in the relationship between phish and real emails. This wastes security staff's time. Or maybe you want that. They tend to be a bit weird and annoying.

0xffff210• 7 years ago

That is, I'm just not going to look for, or even open, emails.

How long do you think most people could get away with that without being fired? I'd guess I'd last about a week at most.

Scoundreller16• 7 years ago

I don’t think parent means that in the absolute sense, just the relative sense. As in, not even opening emails where the sender or subject suggests spam.

I’ve almost direct-deleted an email like this, but it turned out that the sender got married and changed their name.

rurp2• 7 years ago

2. Enthusiastic reporting of false positives

I used to work in a casino that sent out a notice to all employees urging them to report more suspicious activity. There was no information or training given on what specifically to look for.

After some time the initiative was deemed a great success. Although there had been zero improvement in the rate of dangerous activity stopped or prevented, there had been a giant increase in the amount of reports that turned out to be false.

greedo5• 7 years ago

We just implemented the Phishhook Outlook addon. I'm sure our Security team will love getting 9000 emails a day to sort through (3 per day per employee).

dmbaggett• 7 years ago

Phishing is frankly an embarrassment for the mainstream security community. The temptation is to "blame the stupid users" -- but the truth is that even a script kiddie can take a real email from a mainstream brand, "Save As HTML...", change one link, and resend... and snare even sophisticated victims. This BlackHat talk (https://www.youtube.com/watch?v=Z20XNp-luNA) shows just how easy it is to phish even users who think they are too good to be fooled.

At Inky (https://inky.com) we're using a combination of computer vision, anomaly detection, and domain-specific hacks to identify zero-day phishing emails "from first principles" (as I like to say). And it works! But the pushback from the security establishment is impressive. I like to say that there are two widely-held but false beliefs about phishing: 1) phishing is solved; 2) phishing is unsolvable.

The truth is that we can already see clearly that within 3-5 years machines will be good enough at identifying phishing emails that attackers will move to another vector... but you'd never know it listening to "Security Thought Leaders."

rurp2• 7 years ago

The truth is that we can already see clearly that within 3-5 years machines will be good enough at identifying phishing emails that attackers will move to another vector...

Claiming that a complicated problem involving a lot of humans, that is very much not solved at the moment, can expect to be fully "solved" in 3-5 years stretches my credulity.

I fully expect the next decade to look much like the past several decades, with both sides of the security arms race making incremental adjustments and improvements.

mg794613• 7 years ago

I know no civilised country which law would allow such a thing. Maybe for military or something, but anything else would simply not fly as it instigated and fake. What if they responded OK in a real situation? Also it would completely kill your workforce morale. Do you really want to run a fear based organisation?

Scoundreller16• 7 years ago

I find such situations quite motivating to look for other jobs. In my industry, it usually means they’re going to implode.

But if you’re running a monopoly, you’ll continue to exist, just in a poorly functioning state that people have to deal with anyway.

chris_st• 7 years ago

Can we fire the security people at our company who test us for phishing attacks, and then send us emails (with off-company links!) to polls, etc., that are required... and all the "security" in these emails is words like "THIS IS A REAL EMAIL FROM THE COMPANY!!!"?

Sigh...

detaro• 7 years ago

Report all those emails as suspected phishing attempts?

viraptor• 7 years ago

I'm interested if the company which would fire a random employee for 3 strikes would also fire a VP-level employee. If they don't, then it's just BS, not security, given how much more access a VP level person has.

crazygringo• 7 years ago

Should Failing Phish Tests Be a Fireable Offense?

In one way, it's pretty easy to answer: if firing offenders results in real costs from successful phishing efforts decreasing more than the cost of hiring and training people and any side effects from worse morale... then yes.

But unless you're working with state/military secrets where lives could be at risk, or on the security teams of financial institutions where a mistake could lose tens of millions of dollars...

...then probably not.

lalaithion• 7 years ago

Two factor auth prevents most phishing attacks from being ultimately successful, and two factor probably is easier and better on morale to successfully implement, especially with hardware security keys nowadays.

NoPicklez• 7 years ago

I work at a firm that creates and sends these phishing tests for our clients. Prior to doing this type of work we always assess the "tone at the top" regarding the culture of the workplace, to assess the suitability of doing these tests.

However, if there are staff that repeatedly fail these tests and receive constant training, then that's a question for the business in how willing they are to accept the risk.

Given that there are tools that can quite often successfully block these types of emails before they get to the end user. Most often when we are crafting these emails we need to ask the IT teams to unblock the domain.

In my opinion I think in most cases no, however depending on the industry and the strike rate you might have a case for it at some point.

joshuak• 7 years ago

As the article implies, absolutely not, and obviously so. Do not make enemies of your own staff, a hostile workplace is exploitable, not to mention unpleasant and demotivating.

My god are people bad at security. Security people especially so. Actual security is not bound to the mechanics of securing things. It is bound entirely to risk. Did you just fire the best accountant your company has because they were too focused on solving your huge tax liability to notice a phishing attempt. Risk.

Everyone is fallible including your IT security group. If phishing attacks are actually causing appreciable damage to your company, it's the security group who needs replacing. Can they report quantitatively how much more value your organization has captured with it's 90 day password replacement policy, and does it account for all the passwords written on post-it notes laying round, and the productivity impact of constant forgotten passwords?

The purpose of security is to mitigate the risk of loss, but so is insurance. Don't fixate on the machinery of security, and don't fire people for poor email filtering who's value is not to filter emails.

overgard8• 7 years ago

In my experience, gullibility has little to do with innate intelligence and is rather correlated with how much trait neuroticism you have (ie distrust of other people/the world). So in a sense if you were to fire the most gullible employees you might be inadvertently be selecting for neuroticism, which you may not want (unless you're in a very security oriented business where that could be a useful trait)

pugworthy2• 7 years ago

The fortune 50 company I work for sends out what I must consider the stupidest phishing test emails I've seen. They are blatantly simplistic and transparent.

I have had this fantasy of trying to see if I could trick the IT people who send them with a phishing attempt. It would involve perhaps reporting that my virus scanner had reported something suspicious in an email to get them to open something.

Or maybe register mimecastprotection.com, then send out a fake email to IT as if it was a big marketing announcement from Mimecast that "We've changed our name! We are now Mimecast Protection as part of our commitment to serving you!"

My theory is that a really well crafted phishing email is going to be very hard to avoid.

brootstrap2• 7 years ago

people on my team fall for it every time our corporate IT security people send the tests. I'm like jesus guys did you look at ANY part of the email?

pugworthy2• 7 years ago

One thing to understand about phishing is that it isn't necessarily from outside.

Our (large) company recently had a sort of big (we think) leak of internal source code from a GitHub Enterprise server - done by an internal person who DL'ed a bunch of code and put it outside.

Basically no security system in the world would have stopped that, as long as we think the idea of sharing source code internally is a good idea.

So yea - the guns all point out, and if anyone inside your organization ever tries to phish you, there's a good chance you'll never see it coming.

musicale• 7 years ago

It makes no sense to blame users for doing perfectly normal things like clicking on web links, reading email, opening attachments, reading a memory card, connecting to a wireless network, etc. rather than blaming hardware and software developers for designing systems where perfectly normal actions result in criminals taking over your computer.

It also makes no sense to blame users for thinking an email message is from their bank when there is no obvious, visible difference between messages from their bank and messages from criminals.

techntoke• 7 years ago

Except the URL is usually nothing like your banks.

kpmcc• 7 years ago

Definitely read this headline as "Can we fire our coworkers for liking the band Phish?"

Amboto2205• 7 years ago

In the real world, i.e. Evolution, if you fall for the predator’s camouflage, you help your species thrive by removing yourself from the gene pool. If your fellow herd-members see you being taken down, that has a tendency to raise their awareness. If not then they follow the same evolutionary path…

infosecdude64• 7 years ago

It depends on the industry and their regulatory obligations as well as their risk tolerance. Defense and Finance should have a 3 strikes rule for specific role within their orgs that produce the greatest risk. Health care would be next up and may or may not benefit from a 3 strike rule.

I think a better question would be is Sr Leadership supporting the security and risk mgmt teams in developing proper training as well as implementing and spending the money on the proper controls to help reduce the risk to the end user of being spear phished?

lamontcg• 7 years ago

At a prior job it was mostly executives who were the worst at being phished.

Should Failing Phish Tests Be a Fireable Offense?

Related Stories