We still train people to spot a suspicious email? Is that still a thing? What about the Teams message from…
Lara B. — Building Cyberr
We still train people to spot a suspicious email?
Is that still a thing?
What about the Teams message from “IT,” the MFA reset call, the wapp or LI message that looks normal, or the fake CAPTCHA ...
Social engineering has moved way beyond email.
But has security awareness training moved with it?
9 reactions · 17 comments
Comments
Walid N.: Yes of course, because people are still falling victims to phishing emails, last month I did a case study, shared it in a session where I was providing training, since phishing is developed with ai, and it gets authentic information about the target person, it is no longer that prince in Nigeria that wants to send you all his inherited money, it is developed to target specific individuals with aut
George B.: The SPF/DKIM part is probably the interesting bit here. Passing both doesn’t mean the sender is legitimate — it only means the message was authorized by the domain it came from and wasn’t modified in transit. An attacker using a lookalike domain, compromised tenant or legitimate SaaS account can pass both perfectly. So “check the sender/authentication” is becoming a pretty weak thing to teach user
Scott D.: In my experience, we never actually trained them beyond a few PowerPoint slide examples at a lunch and learn session. Really sitting down and showing personnel some of the better phishing emails is met with surprise to this day. So, no we are not evolving our training well with new social engineering capabilities in my opinion.
Keola: Scott DS, I couldn't agree more. I think of a recent incident in which government employees fell for one. One individual even paid for gift cards before being told it was a phishing attempt. Need to learn and practice the basics, first. This has been a decades-old problem.
Ben N.: great insight, Lara.