Security Awareness Training here at Duckbill continues with a plethora of crap advice.
https://twitter.com/quinnypig/status/1364002197743169537
I don't know why @1password doesn't advertise "we won't auto-fill on phishing sites" more heavily, because it's the single biggest red flag that something's suspicious.
The training of course finds "a password manager validates the strength of your passwords" incorrect.
The training of course finds "a password manager validates the strength of your passwords" incorrect.
"When someone sends me an unexpected attachment I should forward it to the IT department so they can" kill me with an axe after the fifth time in a row? My god.
It alludes to "password management software is available" without naming any of them or, y'know, ASSUMING THAT A COMPANY THAT IS HALFWAY COMPETENT WILL PROVIDE SUCH A THING.
Skimping on *THAT* is like saving on S3 charges by deleting all of the backups.
Skimping on *THAT* is like saving on S3 charges by deleting all of the backups.
No mention whatsoever about "the CEO will never email you in a hurry telling you to wire large sums to rando bank accounts" or "send all of the payroll data / employee W-2 information to me via email."
And of course the honest "get a weird email or phone call? Double check via Slack" or similar is nowhere to be found.
Ooh! It *did* highlight business partners as potential insider threats. I dunno wtf it thinks I can do if @mike_julian decides to turn evil; that goes beyond "infosec" and into "litigation slapfight."
• • •
Missing some Tweet in this thread? You can try to
force a refresh
