173
Study concludes cybersecurity training doesn’t work (www.kpbs.org)
submitted 1 year ago by to c/cybersecurity@infosec.pub
48 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 1 year ago (4 children)

It's also such a dumb metric because most of people's jobs are to click on links elsewhere on the internet, yet when it's in an email, it's bad? Unless you're running an old browser or there is a 0 day, simply opening a link isn't going to hack your system, but further actions by the user would need to be taken to be compromised. These simulations don't account for that.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 1 year ago (2 children)

    Clicking the link hypothetically confirms to the spammer that yours is a valid and monitored email address, and that you're a sucker suitable for more targeted phishing.

    Of course, it seems like every random user will also happily type their password into any text box that asks for it, too.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 year ago (1 child)

    Unless the email client is blocking external images, a tracking pixel in the email would be enough to see that the email was rendered, and that the address is valid. The trainings specifically instruct you to review the contents of the email and check the email headers before clicking links, so that alone would confirm to a spammer that the email is valid.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •