Phishing

[W3WN]

Back in February, we had mandatory training for all users in the building, about what to do about suspicious emails, attachments, and anything else that could constitute a Phishing attempt.

So, yesterday afternoon, one of our users gets an unexpected "view information in spreadsheet" email, allegedly from a client.

E-mail address is not the client's. Not even close.
The e-mail recipient is not her, nor that of the account exec.
There is no Excel spreadsheet attached. There is a PDF that tells the reader to go to a portal site and create a login.

Classic signs. Almost exactly what we covered in the class. So what does she do? In order:

Opened the email
Opened the PDF
Followed the link
Entered her company email address on the site, and created a password (which she swears she has never used anywhere else)
Attached the suspicious email & attachment to our file management system
Forwards the email, with attachment, to the account exec
Forwards the email back to the original sender, which verifies it's a legit email address
Forwards the email to the client, at his actual email address, and asks if he really sent this.
Finally, opens a Help Desk ticket to let us know.

I was on my way home when this happened, so I immediately replied to her via email DON'T OPEN THE EMAIL UNTIL FURTHER NOTICE. Her reply? "Oh, he changes his email all the time." followed by "Maybe it's his father's email"

KB3ERQ, who was still "on duty", took over at that point and went to talk with her. She denied she did anything wrong, and insisted that we had to help her open the "spreadsheet". Only after the actual client replied to her, 3 hours later, saying "my email was hacked, don't open anything" would she admit that maybe, just maybe, something wasn't quite right.

(They had a long and somewhat unpleasant conversation, which I'm skipping over. To put it bluntly, we can't figure out if she's stupid, stubborn, or trying to cover her anatomy -- or some combination thereof)

*sigh*

No, I'm not allowed to shoot her.

We are going to sit down and have a word with our boss, followed by the three of us having a word with the company Compliance Officer who ran the seminar, and then a word with the user's supervisors. HR might have to get involved as well. Suffice to say that she won't be happy with us afterwards. I THINK we dodged a bullet -- this time. We won't get so lucky the next time, though.

[ No, I can't summarily fire her. Or I would have. ]

[KJ3N]

(... To put it bluntly, we can't figure out if she's stupid, stubborn, or trying to cover her anatomy -- or some combination thereof)

To paraphrase from one of my favorite movies: "Woman, you don't know whether you've been shot, fucked, powder-burned or snake-bit."

[N8YX]

In some circles, the first strike is a mandatory write up and suspension if A) You've taken said security training, and B) Your actions caused your employer to experience significant loss, damage to brand or both.

In certain other (tighter) circles, it wasn't a game of baseball. Strike 2 involved you being escorted to the parking lot via the HR office by me and one or more of my contemporaries (when I worked Operations).

This kind of scenario belongs as a set of questions in the interview process, as an idiot screen.

[W2NAP]

what a mess

[W3WN]

In some circles, the first strike is a mandatory write up and suspension if A) You've taken said security training, and B) Your actions caused your employer to experience significant loss, damage to brand or both.

In certain other (tighter) circles, it wasn't a game of baseball. Strike 2 involved you being escorted to the parking lot via the HR office by me and one or more of my contemporaries (when I worked Operations).

This kind of scenario belongs as a set of questions in the interview process, as an idiot screen.

Ah, yup.

Unfortunately, I don't believe (Middle) Management will take this type of thing seriously until someone gets hosed. And we've had some close scares before, but nothing... yet. They are not grasping that just because we keep dodging bullets doesn't mean we will always be able to do so.

The owners do take it seriously, but when it comes to things like this person's actions, they may not hear about it from middle management until it is too late.

IT takes it VERY seriously. And our boss is dealing with this. Suffice to say that the excuse of "oh, she's been here many years and is set in her ways" is NOT an acceptable answer -- to us.

[N8YX]

...
IT takes it VERY seriously. And our boss is dealing with this. Suffice to say that the excuse of "oh, she's been here many years and is set in her ways" is NOT an acceptable answer -- to us.

Your firm may need to implement detective and preventative controls if the owners aren't willing to take the heavy-handed approach. IDS/IPS and DLP technologies are a good starting point, but what you'll need to be truly effective in that space is behavior-based detection, coupled with white-listing of permitted actions and resources.

In a nutshell: If Suzie is attempting to use her domain credentials outside of her work domain (i.e., registering a profile on an external URL) that action is blocked and an alert sent to Operations. Products in this space are available in inline, endpoint and hybrid configurations. If your staff is permitted to take their laptops home with them, I strongly recommend the use of comprehensive endpoint protection, controlled by a central management server (with no way for users to defeat it).

[K4PIH]

Was her last name Podesta?

[W3WN]

Your firm may need to implement detective and preventative controls if the owners aren't willing to take the heavy-handed approach. IDS/IPS and DLP technologies are a good starting point, but what you'll need to be truly effective in that space is behavior-based detection, coupled with white-listing of permitted actions and resources.

In a nutshell: If Suzie is attempting to use her domain credentials outside of her work domain (i.e., registering a profile on an external URL) that action is blocked and an alert sent to Operations. Products in this space are available in inline, endpoint and hybrid configurations. If your staff is permitted to take their laptops home with them, I strongly recommend the use of comprehensive endpoint protection, controlled by a central management server (with no way for users to defeat it).

I hear you.

A recommendation to that effect was already made. I do not know where it stands at the moment.

[W3WN]

Was her last name Podesta?

No, but it ought to be "Putz"

In all fairness, there've been about 20, 25 or so of these types of phishing emails that we've been made aware of in the last few weeks. I'm sure there have been more... most of our more savvy users simply nuke them to begin with and don't bother to tell us.

But, as we all know, it just takes one, just one, stubborn idgit...

[KG4CGC]

Has HR started an investigation into her past action(s) regarding her disregard for the security and reputation of the company?