Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/21/2010
08:16 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Wombat Launches PhishGuru

SaaS application provides training to users when implementing a penetration test or security assessment

PITTSBURGH, PA September 21, 2010 – Penetration testing and security assessments are invaluable to an organization’s information security program. With the rise of targeted phishing attacks, these tests need to also cover the preparedness of an organization’s workforce. These kinds of evaluations are also increasingly required to maintain compliance with laws, regulations and emerging industry standards such as FISMA, HIPAA, GLBA, FERPA, and PCI-DSS. However, there are downsides if these tests are conducted without proper preparation.

One such case of a penetration test going wrong involved security testers at Andersen Air Force Base sending an in-house simulated phishing email to airmen. The email stated that Transformers 3 would be filmed in Guam and invited the airmen to fill out online applications asking for sensitive information. This kind of exercise is routine for the military and major corporations, but it worked too well when personnel not only responded to the email, but then forwarded the email outside of the base. The rumor that Transformers 3 would be casting extras for the upcoming film spread like wildfire on fan sites and local media. The base had to begin the long and tedious process of informing their employees and local press about the simulated attack.

Rebecca Herold, owner and CEO of Rebecca Herold & Associates, LLC said, “All types of audits and security reviews, including penetration tests, have the possibility of backfiring without proper planning. This has happened in many organizations, of all sizes. To avoid the potential downside of a pen test, it is important to be clear about what has just taken place at the moment the employee has fallen for the simulated attack. This helps to prevent confused and upset employees, numerous calls to the IT department, and negative press.”

How do you negate the adverse effects on the employees of a penetration test? Multiple studies have shown that employees are more receptive to training and able to learn more when training is delivered at the time of the pen test. Wombat Security Technologies’ PhishGuru is a Software-as-a-Service (SaaS) application that lets security professionals provide immediate training to users when implementing a penetration test or security assessment. Using PhishGuru, security professionals can craft a fake phishing email from a variety of templates or create a custom attack that matches actual phishing messages already being sent to employees. They can also incorporate just-in-time training within the simulated attack, so that if an employee clicks on the fake phishing link, he or she receives a training cartoon that describes phishing and teaches them effective strategies for identifying and avoiding future attacks. Herold said, “The PhishGuru approach is unique. It takes advantage of the teachable moment that occurs when users believe they just fell for an attack by providing them practical tips right at that moment. The end result: users have been shown to be more likely to remember and apply those tips when confronted with real phishing attacks.” Another important benefit of such immediate feedback is that training campaigns don’t run amok like the one conducted in Guam.

PhishGuru’s training can also be reinforced with Wombat’s award-winning interactive training modules Anti-Phishing Phil and Anti-Phishing Phyllis. “Wombat’s unique suite of anti-phishing training solutions is by far the most comprehensive and most effective available today,” said Wombat Co-Founder and CEO, Dr. Norman Sadeh. Numerous in-depth evaluations of the suite’s effectiveness, including a study recently published in Scientific American, shows that a single campaign can reduce the chance of an employee falling for subsequent phishing attacks by more than 50 percent, with even more impressive reductions seen after just a few campaigns.

About Wombat Security Technologies With millions of users across North America, Europe, and Asia, Wombat Security Technologies is a global leader in cyber security awareness training and also offers unique anti-phishing filtering solutions. Wombat’s products have been licensed for use in sectors as diverse as finance, government, healthcare, insurance, energy, e-tailing, logistics and education to name just a few.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why AI Will Create Far More Jobs Than It Replaces
John DiLullo, CEO, Lastline,  5/14/2019
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
Baltimore Ransomware Attack Takes Strange Twist
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12216
PUBLISHED: 2019-05-20
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a heap-based buffer overflow in the SDL2_image function IMG_LoadPCX_RW at IMG_pcx.c.
CVE-2019-12217
PUBLISHED: 2019-05-20
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL stdio_read function in file/SDL_rwops.c.
CVE-2019-12218
PUBLISHED: 2019-05-20
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is a NULL pointer dereference in the SDL2_image function IMG_LoadPCX_RW at IMG_pcx.c.
CVE-2019-12219
PUBLISHED: 2019-05-20
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an invalid free error in the SDL function SDL_SetError_REAL at SDL_error.c.
CVE-2019-12220
PUBLISHED: 2019-05-20
An issue was discovered in libSDL2.a in Simple DirectMedia Layer (SDL) 2.0.9 when used in conjunction with libSDL2_image.a in SDL2_image 2.0.4. There is an out-of-bounds read in the SDL function SDL_FreePalette_REAL at video/SDL_pixels.c.