Two issues with this:
1) no mention of U2F; vastly superior to OTP
2) “watch out for phishing” is near useless advice. A well-written phishing email will catch the most seasoned security professional. The only fix is: see #1 above
1) no mention of U2F; vastly superior to OTP
2) “watch out for phishing” is near useless advice. A well-written phishing email will catch the most seasoned security professional. The only fix is: see #1 above
I disagree, this "most seasoned security professional" won't reply to that e-mail if "nobody will ever ask for your credentials on any channel" is part of the hygiene. No matter how well written it is, even if the CEO got his actual legit e-mail hijacked it should not work. Follow proper procedures or fuck off is the only valid answer.
A well-timed, creative phishing campaign can include things like a “regarding your employment status” right after the company announces layoffs, if you’re talking malicious actor and not watered-down security awareness exercise