Hacker News Reader

Comment by Enginerrrd | Hacker News Reader

I'm convinced there's no way to solve this except for regular "red shirt drills" linked to your job performance. (This is a term I borrowed from life-guarding where someone randomly pretends to drown to see if/how fast the guard will catch it and assess the skills of their response.)

View on HN

> a term I borrowed from life-guarding where someone randomly pretends to drown to see if/how fast the guard will catch it and assess the skills of their response

They have a similar concept in cybersecurity.

The Red Team

> a group that plays the role of an enemy or competitor to provide security feedback from that perspective. Red teams are used in many fields, especially in cybersecurity, airport security, law enforcement, the military and intelligence agencies.

https://en.wikipedia.org/wiki/Red_team

Good detection and response is a must, but creating a security culture helps greatly. Training, test campaigns, and further training for those that fail, does help. Nothing is a silver bullet, that is why we emphasize "Defense in Depth."

Even that doesn't work - some companies do exactly that with regular phishing exercises etc.

Employees get really good at spotting the tests.

The technical ones may, but they're also less likely to fall victim to the phishing schemes.

It's those non-technical folks in admin roles that you tend to have to worry about most. Those folks aren't so good at picking out the tests.

I actually found KnowBe4 to work fairly well on a large scale.

The non technical staff seem to learn to spot the knowbe4 shit real quick lol.

Yep. All of KB4s stuff looks like it came from a single designer. You need to go through your spam filter and make custom templates from whatever you are receiving, and also make lookalikes from real business messages. Bankers doing wire transfers to wrong accounts because of a forged document has been a serious problem in my sphere lately.

It used to be that if a mailbox got compromised they would just send spam about lottery wins and boner pills. Now they watch your messages and reply to a real request with a good looking response. A correct expected reply in a chain from an authentic account, just some numbers have changed. Then they will steal your contacts and register a similar domain and try to impersonate you.

We had almost this exact scenario (look alike domain) play out with a customer. Their accounts payable department almost paid out half a million to a scammer. Fortunately the employee at the customer accidentally replied to our actual email address and our folks knew better and picked up the phone. The customer insisted up and down that their email system had not been compromised. It took telling their IT folks what and where to look before they finally realized they were compromised. Good IT/security teams make all the difference.

> A correct expected reply in a chain from an authentic account, just some numbers have changed.

Ooof, that'd be a tough one not to fall for.

It's all in how much effort you put into it. It's quite versatile and their customer success team is phenomenal. We had multiple pretty smart employees accidentally fall for it the first few campaigns and immediately reach out when they realized what they did.

> Employees get really good at spotting the tests.

Then surely either the test isn't good enough, or the problem is solved?

If being able to spot the tests doesn't confer ability to spot real phishers, then the tests aren't very good.

Reply on news.ycombinator.com