656
The Work Phishing Email Test Was Suddenly Halted (reddthat.com)
submitted 3 months ago by to c/dull_mens_club@lemmy.world
127 comments fedilink hide all child comments
 

Can’t make the wrong people look bad.

you are viewing a single comment's thread
view the rest of the comments
[–] 45 points 3 months ago (11 children)

Ive often suggested to our security team that they send one out spoofing the monthly mandatory training vid

  • permalink
  • fedilink
  • source
  • hideshow 11 child comments
    •
  • [–] 60 points 3 months ago (8 children)

    The issue is that people's egos get bruised when they fall for it, and they'll very quickly get management on their side that certain ones are unfair, as if phishers give a shit about fair.

    What I really love is how my workplace uses some man in the middle crap to replace every link in every email with a new one redirected through our cyber security link scanning product, so now there's no way to check the actual link before you click it since they're all just like garbagesec.com/4a12c89e7f now.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 23 points 3 months ago (3 children)

    Our IT solution to that was to MITM all the links except for the phishing tests. So anyone savvy enough to realize that always passes.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 14 points 3 months ago

    But real phishing emails will have the same treatment as normal emails making them harder to detect. Sounds like a really bad system that probably doesn't offer any advantages over a pihole.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 3 months ago (1 child)

    At work, we use Safe Links in Microsoft Defender so examining the URL of a link in an email was always a pain, but Microsoft actually made a useful change recently. Now when I over over the link in Outlook, it displays the Original URL without all of the Safe Links gibberish. The link itself still goes through Safe Links, but the hover shows me the destination URL. I was pleasantly surprised when I noticed this.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 21 points 3 months ago (1 child)

    PFF I don't click on any training emails unless my manager is asking about it in person.

    If it's not important enough for them to follow up on, it's not important.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 5 points 3 months ago

    Yeah I created a rule that checks for a specific header in the mail from the phishing test platform, and junks those emails. Luckily, also the monthly security training emails also have the same X header

  • permalink
  • fedilink
  • source
  • parent