Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Clinton Campaign Tested Staffers With Fake Phishing Emails
Newest First  |  Oldest First  |  Threaded View
ChispaTD
50%
50%
ChispaTD,
User Rank: Apprentice
2/21/2017 | 3:45:12 PM
Re: What a Surprise!
I'm not surprised. The fastest way to get someone to do something, especially an exec, is to tell the person not to do it. 
ChispaTD
50%
50%
ChispaTD,
User Rank: Apprentice
2/21/2017 | 3:29:26 PM
Re: What a Surprise!
I'd like to know that as well. How effective is it to run these tests if it's not rolled out across the entire organization?
mikeroch
50%
50%
mikeroch,
User Rank: Apprentice
2/20/2017 | 9:59:30 AM
Email phishing for 192.168 0l 1
Email phishing is hell, it should not be executed at any cost.
Joe Stanganelli
100%
0%
Joe Stanganelli,
User Rank: Ninja
2/20/2017 | 5:30:13 AM
Re: What a Surprise!
@Terry: I'm aware of at least one situation in which fake phishing emails were sent within a major organization explicitly warning users "DO NOT CLICK ON THIS LINK" and explaining that it was an example of a phishing email.

10% of the users still clicked -- including one C-suiter.

The C-suiter's justification for clicking?  "I wanted to see what would happen."
tompendergast
100%
0%
tompendergast,
User Rank: Author
2/17/2017 | 10:48:51 AM
Re: What a Surprise!
Good article, thanks. I'm convinced that it's the combination of simulated phishing, relevant training, and persistent reinforcement that is the key to building up human capacity. It sounds like this group did it right. 
kasstri
100%
0%
kasstri,
User Rank: Strategist
2/16/2017 | 5:43:48 PM
keyboard
This is really a nice post. Thanks for sharing this us.
T Sweeney
100%
0%
T Sweeney,
User Rank: Moderator
2/16/2017 | 1:44:01 PM
Re: What a Surprise!
I understand wanting to protect the egos of execs, but at the expense of the organization's security?

Is the assumption, then, that your execs open all their email (unlikely) and click on all links (very unlikely)?

Separately, I'd love to know how common this practice is of sending fake phishing emails to test training effectiveness, and what other conditions get used in the exercise.
jries921
50%
50%
jries921,
User Rank: Ninja
2/16/2017 | 11:55:42 AM
Re: What a Surprise!
If the practice really does have management support, then senior managers won't be exempted.  If John Podesta was exempted, I'm sure he regrets it now.
ClarenceR927
50%
50%
ClarenceR927,
User Rank: Strategist
2/16/2017 | 9:35:32 AM
What a Surprise!
We test too. Naturally we are not allowed to send our test phish upstream in the coproration as it would be embarassing for the executives to get caught.  I wonder if Podesta as also skipped on the tests.


Look Beyond the 'Big 5' in Cyberattacks
Robert Lemos, Contributing Writer,  11/25/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: I think the boss is bing watching '70s TV shows again!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-26250
PUBLISHED: 2020-12-01
OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated (in jupyterhub 1.2) configuration `Authenticator.whitelist`, which should be transparently mapped to `Authenticator.allowed_users` with a warning, is instead ignored by ...
CVE-2020-28576
PUBLISHED: 2020-12-01
An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal version and build information.
CVE-2020-28577
PUBLISHED: 2020-12-01
An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal server hostname and db names.
CVE-2020-28582
PUBLISHED: 2020-12-01
An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal number of managed agents.
CVE-2020-28583
PUBLISHED: 2020-12-01
An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal version, build and patch information.