That's the real point-- while there are probably some good things that may
come of it (the "active user education" adaptation Gadi spoke of) there are
far too many things that could (and often will) go wrong. And like I said
before, even if things "go right" it is not a valid metric for success. My
users know that I will never send them an executable attachment. Ever.
That is "good education" for them. If I were to engage in some internal
"test" of that by actually sending out executable code or mock viruses, it
will only serve to confuse them. I can see someone actually opening a virus
thinking it was a "test" of some sort just to see what it would do.
It just seems like a colossal waste of time when what an admin should be
doing is ensuring all users are not local admins, that decent
antivirus/malware applications are in place, that gateway/firewall products
are properly configured, and that you educate users in a positive manner
with proactive methods and not after-the-fact "bad dog" positioning. That's
what results in effective, robust security.
t
On 2/6/07 3:54 AM, "M.B.Jr." <marcio.barbado@gmail.com> spoketh to all:
actually, this aint new stuff.
last year, London's financial district faced something similar:
http://www.bankinfosecurity.com/articles.php?art_id=147
... with some scary results.
On 2/3/07, Gadi Evron <ge@linuxbox.org> wrote:
On Fri, 2 Feb 2007, Thor (Hammer of God) wrote:
Not withstanding the value of the other replies, the problem with this
method is that the outcome doesn't really prove anything one way or the
other. If he sends a mock virus out and no one opens it, it doesn't mean
that they won't open a real one that comes out the next day. If they do
open his, that doesn't mean they'll actually open a real one in the future.
You can always prove that your users will do something stupid. That's
trivial. If the goal is to actually improve the security posture of your
userbase, then engage in continued user education - not waste your time
trying to get them to open a virus.
Look at it as "active user education".
If you find out who always opens the attachments, or educate more and more
between different such "learning attacks", it is worth it.
It's up to the organization to choose doing it, and just once is
pointless.
t
On 2/1/07 6:55 AM, "Schanulleke" <schalulleke@gmail.com> spoketh to all:
webmaster@absolutenetworks.biz wrote:
We all know our weak link but how do you identify just how weak they are?
I
think it's time to pen test my user community and have a couple ideas to
gather
statistics on just how nonaware they really are.
What is the point you are trying to make, what is the goal you are
trying to achieve?
Maybe a simple phishing scam
and bogus email with a fake virus attachment that emails me when it's
opened
so
I can track how many folks actually opened it. Has anyone ever done this
before? I can't find any information about it on the web.. thoughts and
ideas
anybody?
It all has been done before for real. THere are plenty of real examples
out there. If you have AV check how often it is triggered. Or are you
really trying to prove that your users at 1d10ts?
Frank
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=7016000
000
08bOW
------------------------------------------------------------------------
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=70160000
0008bOW
------------------------------------------------------------------------
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000
008bOW
------------------------------------------------------------------------
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------
