this post was submitted on 31 Aug 2023
1064 points (99.2% liked)
Comic Strips
12552 readers
5106 users here now
Comic Strips is a community for those who love comic stories.
The rules are simple:
- The post can be a single image, an image gallery, or a link to a specific comic hosted on another site (the author's website, for instance).
- The comic must be a complete story.
- If it is an external link, it must be to a specific story, not to the root of the site.
- You may post comics from others or your own.
- If you are posting a comic of your own, a maximum of one per week is allowed (I know, your comics are great, but this rule helps avoid spam).
- The comic can be in any language, but if it's not in English, OP must include an English translation in the post's 'body' field (note: you don't need to select a specific language when posting a comic).
- Politeness.
- Adult content is not allowed. This community aims to be fun for people of all ages.
Web of links
- !linuxmemes@lemmy.world: "I use Arch btw"
- !memes@lemmy.world: memes (you don't say!)
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
We get fake phishing emails that are actually from IT and if we don't recognize and report them, we get a talking-to. It's a good way of keeping employees vigilant.
My last company did this. They'd also send out surveys and training from addresses I didn't recognize, so I'd report those, too, only to be told they were legit π
Yeah this is a running joke at our workplace too. Only to be asked by some manager to do those week or few later
A friend (who actually works in IT) apparently has a good system at his company. It actually automates turning real phishing attempts into internal tests. It effectively replaces links etc and sends it onwards. If the user actually clicks through, their account is immediately locked. It requires them to contact IT to unlock it again, often accompanied by additional training.
Wait. So your friend's company has the ability to reliably detect phishing attacks, but instead of just blocking them outright, it replaces the malicious phishing links with their own phishing links, sends those on to employees, and prevents them from doing their jobs of they fall for it?
Sounds like your friend's company's IT people are kind of dickheads
I work at a company that does something similar; it can be annoying to deal with these fake phishing emails from our own IT, but a 10-15 minute training session if you fail is a lot less disruptive than what can happen if you clicked the real link instead.
I consider myself a bit more tech-savvy than average, but Iβve almost fallen for a couple of these fake phishing emails. It helps me to keep up with what the latest versions of these attacks look like (and keeps me on my toes tooβ¦)
Well the company probably can't detect them reliably, so wih the ones it does detect it trains them to avoid the ones that they can't detect.
I send supervisor emails about stuff I'm not gonna do to my spam folder as well.....
"Did you get the email?"
"Nope, sorry, it looked a little suspicious so I didn't open and sent it to spam.."
Basically you created a echo chamber at work where you can only hear what you want to hear
Lol I don't click shit.
I always just ignore anything that looks dodgy, I can't be bothered to spend the time reporting emails when I get so damn many that are either spam or phishing
No it isn't.
Consider third-party vendor employees who have accounts at your workplace. They don't know what the norms are, or the safe URLs. Half your employees in non-coding roles don't know what the safe URLs are either. There's so much internal SSO mess that just about anything could be a real redirect. Overengineered internal messy networks keep any of this from actually accomplishing its intended purpose of "teaching employees a lesson".
I'm not sure what's worse: that you're teaching them to click on whatever they want because it's impossible to tell the difference, or that you're teaching them to click on nothing, which probably keeps them from doing their jobs.
Stop using email entirely and half of this goes away. Just tell them not to plug in USB drives.
But if they're recognized it means they aren't doing a good enough job faking them
Oh well, time to get better IT guys
That's neat, will steal this.