It's always HR. I've been snidely mentioning how HR is the source of most phishing problems for over a decade.
techcrunch.com/2019/11/17/tri…
techcrunch.com/2019/11/17/tri…
HR regularly sends employees messages that are phishing -- they demand employees give up their credentials. Sure, they aren't malicious, but they are still phishing.
Infosec has no clue how to stop phishing. The reason is that we can no clue how to stop HR from phishing its own employees. As long as businesses rely upon good phishing to conduct business, we can't stop malicious phishing.
Many phishing attacks are blatantly obvious, so we pretend we can just teach users to spot phishing.
The actual effective phishing attacks are indistinguishable from real messages. Nobody can spot the difference BECAUSE THERE IS NO DIFFERENCE.
The actual effective phishing attacks are indistinguishable from real messages. Nobody can spot the difference BECAUSE THERE IS NO DIFFERENCE.
This is typical of the entire infosec profession. Cybersecurity is pursued out of context of the rest of the business, and frequently leads to paradoxes.
You are guilty of two things:
* Why did you click on that message when you weren't supposed to?
* Why didn't you click on that message that you were supposed to?
Either way, it's your fault.
* Why did you click on that message when you weren't supposed to?
* Why didn't you click on that message that you were supposed to?
Either way, it's your fault.
