Hacker News Reader

Comment by worksonmine | Hacker News Reader

> A well-written phishing email will catch the most seasoned security professional.

I disagree, this "most seasoned security professional" won't reply to that e-mail if "nobody will ever ask for your credentials on any channel" is part of the hygiene. No matter how well written it is, even if the CEO got his actual legit e-mail hijacked it should not work. Follow proper procedures or fuck off is the only valid answer.

View on HN

I’ve never ever run a phishing campaign against a medium+ sized organization and had zero hits. It’s great that you think you could never be conned, but I’d be interested if you think that scales to your entire security team.

A well-timed, creative phishing campaign can include things like a “regarding your employment status” right after the company announces layoffs, if you’re talking malicious actor and not watered-down security awareness exercise

We are all very aware of what to watch out for and I trust that anyone with dangerous access is aware, but we're a small shop. I know that humans are the weak link, but my definition of a "seasoned security professional" is not the average Joe that would fall for it. Will some security people fall for it? Absolutely, but they don't deserve the title "seasoned". Especially not if always being cautious of phishing is part of their training/on-boarding. I'd say it makes that rule essential instead of useless.

Reply on news.ycombinator.com