1 00:00:00,160 --> 00:00:02,480 with empathy running successful fishing 2 00:00:02,480 --> 00:00:05,200 campaigns without making enemies and 3 00:00:05,200 --> 00:00:07,520 irritating people 4 00:00:07,520 --> 00:00:09,440 i i find that pretty huge because it's 5 00:00:09,440 --> 00:00:10,639 very easy to 6 00:00:10,639 --> 00:00:11,840 make people mad i think there was a 7 00:00:11,840 --> 00:00:13,360 couple in our live calls today where 8 00:00:13,360 --> 00:00:14,960 people are not fans of their fishing 9 00:00:14,960 --> 00:00:17,279 exercises so without further ado let me 10 00:00:17,279 --> 00:00:20,320 introduce sooyoung chung suyun chung is 11 00:00:20,320 --> 00:00:22,720 a security analyst at eab global a 12 00:00:22,720 --> 00:00:24,480 leading provider of technology marketing 13 00:00:24,480 --> 00:00:26,880 and research solutions for institutions 14 00:00:26,880 --> 00:00:29,920 of higher education in her role at eab 15 00:00:29,920 --> 00:00:32,960 sooyon focuses on risk management it's 16 00:00:32,960 --> 00:00:35,280 time to go time to show for your talk 17 00:00:35,280 --> 00:00:36,719 uh 18 00:00:36,719 --> 00:00:38,320 social engineering with a focus on 19 00:00:38,320 --> 00:00:40,079 conducting phishing engagement and 20 00:00:40,079 --> 00:00:42,160 security awareness she is alumni of 21 00:00:42,160 --> 00:00:43,920 rutgers university and holds multiple 22 00:00:43,920 --> 00:00:46,399 certifications joining her is brian 23 00:00:46,399 --> 00:00:48,559 markham brian markham is an executive 24 00:00:48,559 --> 00:00:50,879 hacker advisor and mentor who is 25 00:00:50,879 --> 00:00:52,160 passionate about 26 00:00:52,160 --> 00:00:54,399 building security programs and teams 27 00:00:54,399 --> 00:00:56,480 he's worked in i.t and security for over 28 00:00:56,480 --> 00:00:59,199 20 years and is currently the cso at eab 29 00:00:59,199 --> 00:01:01,760 global without further ado i will let 30 00:01:01,760 --> 00:01:03,280 brian take it away with fishing with 31 00:01:03,280 --> 00:01:05,438 empathy running successful fishing 32 00:01:05,438 --> 00:01:07,520 campaigns without making enemies and 33 00:01:07,520 --> 00:01:12,280 irritating people good luck thank you 34 00:01:16,479 --> 00:01:18,799 all right what's up sc community 35 00:01:18,799 --> 00:01:21,520 let's party 36 00:01:23,119 --> 00:01:24,799 standard disclaimer while we will 37 00:01:24,799 --> 00:01:26,320 reference things that we did at our 38 00:01:26,320 --> 00:01:27,920 employer this talk does not represent 39 00:01:27,920 --> 00:01:30,560 the views of our employer necessary 40 00:01:30,560 --> 00:01:31,920 all right so what's up first of all 41 00:01:31,920 --> 00:01:33,759 before we start before we introduce 42 00:01:33,759 --> 00:01:35,439 ourselves a little bit more i just want 43 00:01:35,439 --> 00:01:37,520 to say thank you to the volunteers and 44 00:01:37,520 --> 00:01:39,119 sponsors and everyone that made this 45 00:01:39,119 --> 00:01:41,360 happen i'm so stoked that this village 46 00:01:41,360 --> 00:01:43,600 happened this year period but i am even 47 00:01:43,600 --> 00:01:45,680 more stoked to be up here and with all 48 00:01:45,680 --> 00:01:47,520 of you today so thank you so much 49 00:01:47,520 --> 00:01:50,560 everyone that made this happen 50 00:01:53,200 --> 00:01:55,600 so yeah so i'm i'm a cso i'm a social 51 00:01:55,600 --> 00:01:58,560 engineer i'm i'm old um and you can fish 52 00:01:58,560 --> 00:02:00,479 me with uh with sneakers see on you 53 00:02:00,479 --> 00:02:02,719 wanna 54 00:02:03,119 --> 00:02:05,280 this one 55 00:02:05,280 --> 00:02:07,680 hi everyone i'm suyan i'm so happy to be 56 00:02:07,680 --> 00:02:08,639 here 57 00:02:08,639 --> 00:02:10,878 if you want to fish me use vintage art 58 00:02:10,878 --> 00:02:13,840 prints and just fyi it's my first time 59 00:02:13,840 --> 00:02:16,080 here and i'm also presenting so very 60 00:02:16,080 --> 00:02:18,140 excited today 61 00:02:18,140 --> 00:02:21,239 [Music] 62 00:02:22,400 --> 00:02:24,239 all right so let's just talk why cyan 63 00:02:24,239 --> 00:02:26,560 and i uh are here today and what we want 64 00:02:26,560 --> 00:02:29,120 to talk about i think how many here do 65 00:02:29,120 --> 00:02:31,519 fishing simulations 66 00:02:31,519 --> 00:02:33,040 right how many people have had really 67 00:02:33,040 --> 00:02:34,879 are there kids here how many people have 68 00:02:34,879 --> 00:02:36,560 had really weird happen during your 69 00:02:36,560 --> 00:02:38,640 fishing simulations 70 00:02:38,640 --> 00:02:40,239 all right so we're here giving this talk 71 00:02:40,239 --> 00:02:41,760 because we've been doing fishing 72 00:02:41,760 --> 00:02:44,000 simulations and we were just astounded 73 00:02:44,000 --> 00:02:45,280 by the amount of weird stuff that 74 00:02:45,280 --> 00:02:47,519 happened during our fishing simulations 75 00:02:47,519 --> 00:02:49,040 when the light bulb really came on for 76 00:02:49,040 --> 00:02:51,680 me was this fishing sim that we did 77 00:02:51,680 --> 00:02:53,599 where we offered our colleagues our 78 00:02:53,599 --> 00:02:55,840 employees of our company a holiday gift 79 00:02:55,840 --> 00:02:57,040 and they would get to choose which 80 00:02:57,040 --> 00:02:59,040 holiday gift they they got now of course 81 00:02:59,040 --> 00:03:00,400 you had the people that were like mad 82 00:03:00,400 --> 00:03:01,680 that they didn't get their patagonia 83 00:03:01,680 --> 00:03:04,159 jacket but what one of the people did 84 00:03:04,159 --> 00:03:05,760 was they got on the phone and called the 85 00:03:05,760 --> 00:03:08,720 ceo of the company that we impersonated 86 00:03:08,720 --> 00:03:10,319 and i was like all right i definitely 87 00:03:10,319 --> 00:03:12,000 did not expect that to happen so after 88 00:03:12,000 --> 00:03:13,680 like five or six phone calls with that 89 00:03:13,680 --> 00:03:16,239 ceo we finally like smooth things over 90 00:03:16,239 --> 00:03:18,319 and i was like i never want to do that 91 00:03:18,319 --> 00:03:19,200 again 92 00:03:19,200 --> 00:03:21,760 and so i have to like rethink how we do 93 00:03:21,760 --> 00:03:23,360 pretext development 94 00:03:23,360 --> 00:03:25,840 and what potential consequences could be 95 00:03:25,840 --> 00:03:27,840 but really this is why what we do gets a 96 00:03:27,840 --> 00:03:30,239 bad reputation because things like this 97 00:03:30,239 --> 00:03:32,400 happen and it makes people feel bad it 98 00:03:32,400 --> 00:03:33,920 makes people feel like victims like 99 00:03:33,920 --> 00:03:35,440 we've deceived them 100 00:03:35,440 --> 00:03:36,400 and they feel like something 101 00:03:36,400 --> 00:03:38,319 legitimately bad has happened we think 102 00:03:38,319 --> 00:03:39,760 there's a way that you can do fishing 103 00:03:39,760 --> 00:03:42,159 simulations without what really just 104 00:03:42,159 --> 00:03:44,080 like controlling the blast radius and 105 00:03:44,080 --> 00:03:46,159 that's what we want to talk about today 106 00:03:46,159 --> 00:03:47,760 so we have to like just like let's go 107 00:03:47,760 --> 00:03:49,360 back to like the beginning and like why 108 00:03:49,360 --> 00:03:51,599 are we even doing fishing like yeah it's 109 00:03:51,599 --> 00:03:53,200 fun but like that's not really why we're 110 00:03:53,200 --> 00:03:55,280 doing it we're really doing it because 111 00:03:55,280 --> 00:03:57,599 we want to learn about our employee 112 00:03:57,599 --> 00:03:58,720 community 113 00:03:58,720 --> 00:04:00,560 we want to test hypotheses we want to 114 00:04:00,560 --> 00:04:03,040 fuzz test these humans gauge how well 115 00:04:03,040 --> 00:04:04,799 our training and communication works 116 00:04:04,799 --> 00:04:06,640 right this is why crazy stuff happens 117 00:04:06,640 --> 00:04:08,480 like fuzzy in an app weird stuff is 118 00:04:08,480 --> 00:04:10,239 going to happen fuzzing people weird 119 00:04:10,239 --> 00:04:12,400 stuff is going to happen so with this 120 00:04:12,400 --> 00:04:14,159 information in him with these goals in 121 00:04:14,159 --> 00:04:16,880 mind um when we learn about these things 122 00:04:16,880 --> 00:04:18,478 we can figure out how we're going to get 123 00:04:18,478 --> 00:04:21,279 better at having a defense against 124 00:04:21,279 --> 00:04:23,040 phishing attacks not perfect but better 125 00:04:23,040 --> 00:04:24,400 that's all we want to do we want to get 126 00:04:24,400 --> 00:04:27,360 better over time 127 00:04:27,360 --> 00:04:29,280 so a good way to think about this is 128 00:04:29,280 --> 00:04:31,040 really defining your object of measure 129 00:04:31,040 --> 00:04:32,880 so many people get hung up on the click 130 00:04:32,880 --> 00:04:34,880 rates what directions my click rate 131 00:04:34,880 --> 00:04:36,639 going there are so many other ways that 132 00:04:36,639 --> 00:04:38,479 you can measure success here some 133 00:04:38,479 --> 00:04:40,400 quantitative some qualitative these are 134 00:04:40,400 --> 00:04:41,680 just some of the ones that we've come up 135 00:04:41,680 --> 00:04:42,400 with 136 00:04:42,400 --> 00:04:44,160 how do people respond to a suspicious 137 00:04:44,160 --> 00:04:46,400 message are they doing it the way that 138 00:04:46,400 --> 00:04:47,840 they should that you want them to be 139 00:04:47,840 --> 00:04:49,440 doing it do they even know that you 140 00:04:49,440 --> 00:04:51,440 exist do they even know that they have 141 00:04:51,440 --> 00:04:53,120 either a report phishing button or that 142 00:04:53,120 --> 00:04:55,120 there's an email that they can send to 143 00:04:55,120 --> 00:04:56,880 we literally had someone even forward it 144 00:04:56,880 --> 00:04:58,720 to the ceo it's like why would you do 145 00:04:58,720 --> 00:05:00,560 that he's not going to do anything right 146 00:05:00,560 --> 00:05:02,400 like so just figuring that out and 147 00:05:02,400 --> 00:05:04,400 realizing that people do that you can 148 00:05:04,400 --> 00:05:06,320 adjust your communications and training 149 00:05:06,320 --> 00:05:07,520 to make sure that they do the right 150 00:05:07,520 --> 00:05:08,720 thing we'll talk more about that in a 151 00:05:08,720 --> 00:05:10,720 minute how long does it take for them to 152 00:05:10,720 --> 00:05:13,039 report it how many people take the bait 153 00:05:13,039 --> 00:05:14,479 but report anyway so young's going to 154 00:05:14,479 --> 00:05:16,240 talk a little bit more about that who 155 00:05:16,240 --> 00:05:17,919 sets their out of office message to go 156 00:05:17,919 --> 00:05:19,919 to anyone that's also something that we 157 00:05:19,919 --> 00:05:21,680 like to see because that's something we 158 00:05:21,680 --> 00:05:23,919 can talk we can stress more when we do 159 00:05:23,919 --> 00:05:25,199 our training 160 00:05:25,199 --> 00:05:27,120 does a warning banner impact click and 161 00:05:27,120 --> 00:05:28,720 report rates this is how we tested 162 00:05:28,720 --> 00:05:30,560 whether or not to put a warning banner 163 00:05:30,560 --> 00:05:32,479 on external messages we actually tested 164 00:05:32,479 --> 00:05:34,800 to see if the if the click rates were 165 00:05:34,800 --> 00:05:36,880 higher or lower if with with or without 166 00:05:36,880 --> 00:05:38,720 the banner and we actually saw that the 167 00:05:38,720 --> 00:05:40,479 rates were lower with the banner so we 168 00:05:40,479 --> 00:05:42,320 decided to implement it 169 00:05:42,320 --> 00:05:44,400 so here's like a really good example um 170 00:05:44,400 --> 00:05:46,880 so we uh we saw that employees were 171 00:05:46,880 --> 00:05:49,520 reporting phishing to i.t security ceo 172 00:05:49,520 --> 00:05:51,919 head of i.t their supervisor like i said 173 00:05:51,919 --> 00:05:54,080 the ceo of the impersonated company so 174 00:05:54,080 --> 00:05:55,600 our conclusion was our communication 175 00:05:55,600 --> 00:05:57,199 sucked and they were ineffective we 176 00:05:57,199 --> 00:05:59,600 needed to be better at that so our plan 177 00:05:59,600 --> 00:06:01,199 improve communications reinforce the 178 00:06:01,199 --> 00:06:03,120 best reporting method make sure that 179 00:06:03,120 --> 00:06:04,560 it's in all of our training make sure we 180 00:06:04,560 --> 00:06:06,560 remind people all the time and what 181 00:06:06,560 --> 00:06:08,160 happened in the next test the majority 182 00:06:08,160 --> 00:06:09,680 reports came in through the report 183 00:06:09,680 --> 00:06:11,440 phishing button which is what we wanted 184 00:06:11,440 --> 00:06:13,600 people to do so when we saw this we were 185 00:06:13,600 --> 00:06:15,199 like this actually worked like we 186 00:06:15,199 --> 00:06:17,600 actually changed behavior without being 187 00:06:17,600 --> 00:06:19,199 jerks to people without like telling 188 00:06:19,199 --> 00:06:21,039 them you have to do this or if you don't 189 00:06:21,039 --> 00:06:22,319 do this you have to have a conversation 190 00:06:22,319 --> 00:06:24,960 with hr no one likes that right 191 00:06:24,960 --> 00:06:26,479 and and this is like some of the reasons 192 00:06:26,479 --> 00:06:27,840 why we don't want to run fishing 193 00:06:27,840 --> 00:06:29,520 simulations this is why it gets a bad 194 00:06:29,520 --> 00:06:32,319 reputation people can feel like garbage 195 00:06:32,319 --> 00:06:33,840 because we penalize them up and 196 00:06:33,840 --> 00:06:35,919 including termination i talked to 197 00:06:35,919 --> 00:06:38,080 someone this week at this conference 198 00:06:38,080 --> 00:06:40,000 that literally saw someone get fired 199 00:06:40,000 --> 00:06:41,360 from the company because they clicked on 200 00:06:41,360 --> 00:06:43,199 too many phishing emails we do not want 201 00:06:43,199 --> 00:06:44,880 to do that to people we don't have to do 202 00:06:44,880 --> 00:06:46,880 that to people to be good at this but 203 00:06:46,880 --> 00:06:48,880 where to get better against phishing or 204 00:06:48,880 --> 00:06:51,120 to learn about our user community um we 205 00:06:51,120 --> 00:06:52,720 don't want to single out poor performers 206 00:06:52,720 --> 00:06:54,400 with additional training or chats with 207 00:06:54,400 --> 00:06:56,960 hr that again makes people feel bad that 208 00:06:56,960 --> 00:06:59,120 makes security less accessible for them 209 00:06:59,120 --> 00:07:00,560 best case scenario we're building a 210 00:07:00,560 --> 00:07:02,319 community of engaged people they're 211 00:07:02,319 --> 00:07:04,319 never going to be experts like we are 212 00:07:04,319 --> 00:07:06,000 but we want them to know at least where 213 00:07:06,000 --> 00:07:07,680 to go to and that they know that they 214 00:07:07,680 --> 00:07:09,120 can come to us even with something that 215 00:07:09,120 --> 00:07:11,440 they think is silly and that will help 216 00:07:11,440 --> 00:07:12,960 them and that we won't judge them i 217 00:07:12,960 --> 00:07:14,720 literally had a woman cancel her credit 218 00:07:14,720 --> 00:07:16,080 card because she clicked on a phishing 219 00:07:16,080 --> 00:07:18,400 email and i have no idea how she came to 220 00:07:18,400 --> 00:07:20,639 that conclusion like like maybe she 221 00:07:20,639 --> 00:07:21,840 thought her computer was going to blow 222 00:07:21,840 --> 00:07:23,919 up or was like a mr robot situation but 223 00:07:23,919 --> 00:07:25,280 she literally cancelled her credit card 224 00:07:25,280 --> 00:07:26,720 and i was like holy i didn't want 225 00:07:26,720 --> 00:07:29,520 to do that i didn't want that to happen 226 00:07:29,520 --> 00:07:31,039 so we don't want things like that to 227 00:07:31,039 --> 00:07:33,199 happen when we produce a blast radius so 228 00:07:33,199 --> 00:07:34,960 we don't want to do public shaming 229 00:07:34,960 --> 00:07:36,319 something equivalent to like a corporate 230 00:07:36,319 --> 00:07:38,960 wall of sheep we don't want that um we 231 00:07:38,960 --> 00:07:40,400 also do not want to be dunking on our 232 00:07:40,400 --> 00:07:42,160 colleagues like testing out our awesome 233 00:07:42,160 --> 00:07:44,560 apt style pretext like for the red 234 00:07:44,560 --> 00:07:46,560 teamers here you know that's your domain 235 00:07:46,560 --> 00:07:48,319 you guys rock on and do your thing but 236 00:07:48,319 --> 00:07:50,160 for us doing internal sims we really 237 00:07:50,160 --> 00:07:52,080 don't need to do that i have this like 238 00:07:52,080 --> 00:07:54,000 kind of saying that i stole from someone 239 00:07:54,000 --> 00:07:55,759 called try easier i'm going to talk 240 00:07:55,759 --> 00:07:56,960 about that a little bit when we talk 241 00:07:56,960 --> 00:07:58,800 about pretext development i think we can 242 00:07:58,800 --> 00:08:00,400 all afford to try a little bit easier 243 00:08:00,400 --> 00:08:02,160 with our pretext development 244 00:08:02,160 --> 00:08:03,680 so let's look at what happens when 245 00:08:03,680 --> 00:08:05,680 pretext development goes completely off 246 00:08:05,680 --> 00:08:07,199 the rails 247 00:08:07,199 --> 00:08:08,800 so this was a tweet that got sent out 248 00:08:08,800 --> 00:08:10,240 back in the spring 249 00:08:10,240 --> 00:08:13,440 this company did a uh 250 00:08:13,440 --> 00:08:14,800 phishing campaign that offered their 251 00:08:14,800 --> 00:08:17,840 employees a 7 500 stipend because times 252 00:08:17,840 --> 00:08:19,840 were tough with kovid 253 00:08:19,840 --> 00:08:21,520 this was obviously horrible it made 254 00:08:21,520 --> 00:08:23,840 people feel horrible people hurting in 255 00:08:23,840 --> 00:08:25,360 the economy actually thought they were 256 00:08:25,360 --> 00:08:27,039 going to get 7 500 257 00:08:27,039 --> 00:08:28,720 so they clicked to learn more only to 258 00:08:28,720 --> 00:08:30,639 find out like surprise this actually 259 00:08:30,639 --> 00:08:33,760 wasn't real the joke's on you um so this 260 00:08:33,760 --> 00:08:35,519 got picked up by the union and they 261 00:08:35,519 --> 00:08:37,360 actually wrote a blog post about it and 262 00:08:37,360 --> 00:08:39,519 i pulled this quote out of the blog post 263 00:08:39,519 --> 00:08:40,559 which i think 264 00:08:40,559 --> 00:08:42,159 i couldn't say it any better and i'll 265 00:08:42,159 --> 00:08:43,760 read it while this was certainly an 266 00:08:43,760 --> 00:08:46,480 effective way for ohsu to run this test 267 00:08:46,480 --> 00:08:48,160 one does have to wonder if waging 268 00:08:48,160 --> 00:08:49,680 psychological warfare on your own 269 00:08:49,680 --> 00:08:51,279 employees is the best way to educate 270 00:08:51,279 --> 00:08:54,240 them on cyber security 271 00:08:54,240 --> 00:08:55,839 i don't want to get blown up like that 272 00:08:55,839 --> 00:08:57,120 like 273 00:08:57,120 --> 00:09:00,000 right i don't think any of us do right 274 00:09:00,000 --> 00:09:02,480 so like i said we want to try easier we 275 00:09:02,480 --> 00:09:04,480 want to use everyday corporate asks 276 00:09:04,480 --> 00:09:07,200 rather than these elaborate pretexts 277 00:09:07,200 --> 00:09:09,600 we don't have to get crazy with with 278 00:09:09,600 --> 00:09:11,839 these pretext to get the results that we 279 00:09:11,839 --> 00:09:13,920 want to get the data that we want so why 280 00:09:13,920 --> 00:09:15,839 are we doing it we don't need to flex 281 00:09:15,839 --> 00:09:17,279 right all we need is the data all we 282 00:09:17,279 --> 00:09:19,360 want is the outcome we never want to use 283 00:09:19,360 --> 00:09:21,120 fear threats or intimidation we have to 284 00:09:21,120 --> 00:09:22,959 look our colleagues in the eye we have 285 00:09:22,959 --> 00:09:24,800 to work with them on other initiatives 286 00:09:24,800 --> 00:09:26,000 you don't want to walk into a media and 287 00:09:26,000 --> 00:09:27,760 then say there's that a-hole that sends 288 00:09:27,760 --> 00:09:29,440 me those emails and then sends me 289 00:09:29,440 --> 00:09:31,200 mandatory training when i do the wrong 290 00:09:31,200 --> 00:09:32,640 thing you're not going to get things 291 00:09:32,640 --> 00:09:34,160 done as a security team if that's the 292 00:09:34,160 --> 00:09:35,600 way people view you 293 00:09:35,600 --> 00:09:37,040 you don't need to offer a gift or a 294 00:09:37,040 --> 00:09:38,399 prize most people will just click on 295 00:09:38,399 --> 00:09:40,399 stuff anyway to be quite honest with you 296 00:09:40,399 --> 00:09:42,320 like i mean that person that really 297 00:09:42,320 --> 00:09:43,839 wanted the patagonia jacket i thought 298 00:09:43,839 --> 00:09:45,120 seriously about buying it for him 299 00:09:45,120 --> 00:09:47,600 because i felt really bad but really all 300 00:09:47,600 --> 00:09:48,880 you need to do is be like oh hey there's 301 00:09:48,880 --> 00:09:51,040 mandatory uh there's mandatory diversity 302 00:09:51,040 --> 00:09:53,040 training click here or oh you forgot to 303 00:09:53,040 --> 00:09:54,480 record your community service hours 304 00:09:54,480 --> 00:09:56,399 click here that's usually good enough 305 00:09:56,399 --> 00:09:58,080 and if you put you know obviously we 306 00:09:58,080 --> 00:09:59,440 want to test we want to have some hard 307 00:09:59,440 --> 00:10:01,200 tests and some easy tests but if you're 308 00:10:01,200 --> 00:10:03,279 developing the pretext right you can 309 00:10:03,279 --> 00:10:05,519 make these everyday corporate asks 310 00:10:05,519 --> 00:10:06,959 actually look very attractive to the 311 00:10:06,959 --> 00:10:08,480 employee 312 00:10:08,480 --> 00:10:10,000 and also you want to consider the source 313 00:10:10,000 --> 00:10:10,959 right 314 00:10:10,959 --> 00:10:12,800 now the rule the lesson that i learned 315 00:10:12,800 --> 00:10:15,120 from that situation with the ceo 316 00:10:15,120 --> 00:10:16,480 is that 317 00:10:16,480 --> 00:10:18,560 i don't want to impersonate someone that 318 00:10:18,560 --> 00:10:20,720 i want to have to talk to after the fact 319 00:10:20,720 --> 00:10:22,160 and explain why did i do that without 320 00:10:22,160 --> 00:10:23,440 talking to them 321 00:10:23,440 --> 00:10:25,120 right so we have a rule now when we 322 00:10:25,120 --> 00:10:26,560 impersonate someone we talk to them 323 00:10:26,560 --> 00:10:28,800 about it first right and most of them 324 00:10:28,800 --> 00:10:30,320 feel like they're like 325 00:10:30,320 --> 00:10:31,440 like 326 00:10:31,440 --> 00:10:33,279 like like they're in a secret agent 327 00:10:33,279 --> 00:10:35,200 movie or something like they we like 328 00:10:35,200 --> 00:10:37,440 read them into this this art this like 329 00:10:37,440 --> 00:10:39,519 op that we were doing right and so they 330 00:10:39,519 --> 00:10:41,839 like love it right but 331 00:10:41,839 --> 00:10:43,680 oh yeah um 332 00:10:43,680 --> 00:10:45,200 so they like love it and you're getting 333 00:10:45,200 --> 00:10:46,800 them involved and then they're more 334 00:10:46,800 --> 00:10:48,399 aware of what's going on and what you're 335 00:10:48,399 --> 00:10:49,920 doing too so that can be kind of fun to 336 00:10:49,920 --> 00:10:51,760 like work with some non-technical people 337 00:10:51,760 --> 00:10:53,200 people in hr like hey we're gonna 338 00:10:53,200 --> 00:10:55,120 impersonate you you might get some weird 339 00:10:55,120 --> 00:10:57,440 emails just forward them to us right or 340 00:10:57,440 --> 00:10:59,200 you can say you know what i actually 341 00:10:59,200 --> 00:11:00,640 didn't send that you better talk to 342 00:11:00,640 --> 00:11:02,880 infosec right like so we kind of switch 343 00:11:02,880 --> 00:11:04,480 it up but we get them involved and most 344 00:11:04,480 --> 00:11:06,640 of the time they enjoy it 345 00:11:06,640 --> 00:11:08,240 this was one that we sent like just an 346 00:11:08,240 --> 00:11:09,279 example 347 00:11:09,279 --> 00:11:11,200 like complete mandatory community 348 00:11:11,200 --> 00:11:13,760 service training some tells here 349 00:11:13,760 --> 00:11:15,440 where the fact that we use a comp like a 350 00:11:15,440 --> 00:11:18,480 a a domain eab1.com instead of our 351 00:11:18,480 --> 00:11:20,720 regular domain this person doesn't even 352 00:11:20,720 --> 00:11:23,920 exist we just made them up um so 353 00:11:23,920 --> 00:11:25,839 because we want people to like actually 354 00:11:25,839 --> 00:11:27,040 think about this stuff like have you 355 00:11:27,040 --> 00:11:28,800 ever talked to a guy named don before in 356 00:11:28,800 --> 00:11:30,720 talent no yeah because he doesn't exist 357 00:11:30,720 --> 00:11:32,320 right so we want people to be thinking 358 00:11:32,320 --> 00:11:34,480 critically about what they're doing and 359 00:11:34,480 --> 00:11:36,800 cyan will show you in in a moment like 360 00:11:36,800 --> 00:11:39,760 kind of how we do uh like how we debrief 361 00:11:39,760 --> 00:11:41,920 our people on on these fishing tests 362 00:11:41,920 --> 00:11:43,839 once we've done them so 363 00:11:43,839 --> 00:11:46,720 let's cook that fish 364 00:11:50,320 --> 00:11:52,079 okay 365 00:11:52,079 --> 00:11:53,440 um so before we get started just a 366 00:11:53,440 --> 00:11:54,800 couple of things that i want to talk 367 00:11:54,800 --> 00:11:56,720 about so 368 00:11:56,720 --> 00:11:58,560 our whole campaign set up our tool 369 00:11:58,560 --> 00:11:59,839 selection and everything kind of 370 00:11:59,839 --> 00:12:01,920 involved in the process based on the 371 00:12:01,920 --> 00:12:04,480 following objectives so we want to be uh 372 00:12:04,480 --> 00:12:05,760 doing this 373 00:12:05,760 --> 00:12:09,040 oh no you can't hear oh sorry 374 00:12:09,040 --> 00:12:13,440 better oh okay sorry okay so 375 00:12:13,440 --> 00:12:15,200 the objectives that we want to keep in 376 00:12:15,200 --> 00:12:17,120 mind is we want to do this low cost so 377 00:12:17,120 --> 00:12:19,760 how can you do this in the most low cost 378 00:12:19,760 --> 00:12:21,920 effective way um how can you do this in 379 00:12:21,920 --> 00:12:24,320 a very cheap way without you know being 380 00:12:24,320 --> 00:12:26,480 called a cheapskate you know um also 381 00:12:26,480 --> 00:12:28,320 it's about efficiency how 382 00:12:28,320 --> 00:12:30,240 how can you get the most value out of it 383 00:12:30,240 --> 00:12:32,480 and also it's about creating a positive 384 00:12:32,480 --> 00:12:34,880 and meaningful experience so it's about 385 00:12:34,880 --> 00:12:36,880 you understanding and learning about 386 00:12:36,880 --> 00:12:38,320 your company culture and security 387 00:12:38,320 --> 00:12:41,600 behavior but it's about you creating and 388 00:12:41,600 --> 00:12:44,079 kind of fostering this positive learning 389 00:12:44,079 --> 00:12:46,560 experience for your employees so they go 390 00:12:46,560 --> 00:12:49,040 and think oh i did something wrong how 391 00:12:49,040 --> 00:12:50,639 do i 392 00:12:50,639 --> 00:12:52,320 do better how do i do better for my 393 00:12:52,320 --> 00:12:54,560 company and kind of um 394 00:12:54,560 --> 00:12:56,160 improve my own security behavior you 395 00:12:56,160 --> 00:12:57,600 want your employees to be thinking like 396 00:12:57,600 --> 00:12:58,320 this 397 00:12:58,320 --> 00:13:01,440 so the whole not irritating um emphasis 398 00:13:01,440 --> 00:13:03,839 and component about our whole 399 00:13:03,839 --> 00:13:06,560 presentation is about you not irritating 400 00:13:06,560 --> 00:13:08,480 yourself by following these objectives 401 00:13:08,480 --> 00:13:10,480 and not burning yourself out by doing 402 00:13:10,480 --> 00:13:12,079 something really expensive and time 403 00:13:12,079 --> 00:13:14,079 consuming and laborious but it's also 404 00:13:14,079 --> 00:13:15,440 about um 405 00:13:15,440 --> 00:13:17,120 not irritating your stakeholders because 406 00:13:17,120 --> 00:13:19,440 you need that continual buy-in from them 407 00:13:19,440 --> 00:13:20,639 to be able to do your phishing 408 00:13:20,639 --> 00:13:22,959 engagement and also it's not about not 409 00:13:22,959 --> 00:13:25,680 irritating your targets because you want 410 00:13:25,680 --> 00:13:27,760 this to be as i said a positive learning 411 00:13:27,760 --> 00:13:29,120 and meaningful experience for your 412 00:13:29,120 --> 00:13:30,399 employees 413 00:13:30,399 --> 00:13:32,880 at the end of the day 414 00:13:32,880 --> 00:13:35,279 so let's talk about tool selection so 415 00:13:35,279 --> 00:13:37,760 the tools and gear uh here is your email 416 00:13:37,760 --> 00:13:39,839 setup and your phishing toolkit so for 417 00:13:39,839 --> 00:13:41,600 email set up gmail 418 00:13:41,600 --> 00:13:43,760 free very easy to do 419 00:13:43,760 --> 00:13:46,160 and people might think gmail like that's 420 00:13:46,160 --> 00:13:47,920 so easy that's a stupid domain people 421 00:13:47,920 --> 00:13:50,000 are gonna catch that but trust me when i 422 00:13:50,000 --> 00:13:52,560 say people fall for the like all 423 00:13:52,560 --> 00:13:54,000 the time 424 00:13:54,000 --> 00:13:56,720 because in my uh the pretext that i 425 00:13:56,720 --> 00:13:59,199 create it's something about new hire and 426 00:13:59,199 --> 00:14:01,760 i use a like a like a name like 427 00:14:01,760 --> 00:14:06,320 suyunchong like gmail.com people 428 00:14:06,320 --> 00:14:08,720 open that email they click it and they 429 00:14:08,720 --> 00:14:11,519 respond to it asking hey i can't open 430 00:14:11,519 --> 00:14:12,320 this 431 00:14:12,320 --> 00:14:15,360 link be send it to me so gmail works but 432 00:14:15,360 --> 00:14:17,040 if you wanna you know own your own 433 00:14:17,040 --> 00:14:18,720 domain get a little creative you can 434 00:14:18,720 --> 00:14:21,040 definitely do that um through aws and 435 00:14:21,040 --> 00:14:23,279 you just hook it up to aws work mail 436 00:14:23,279 --> 00:14:24,959 very easy to do 437 00:14:24,959 --> 00:14:27,680 for fishing toolkit i use and i do 438 00:14:27,680 --> 00:14:29,440 recommend go fish it's a open source 439 00:14:29,440 --> 00:14:31,440 tool and it's really easy to set up and 440 00:14:31,440 --> 00:14:34,320 the instructions are basically very uh 441 00:14:34,320 --> 00:14:35,920 crystal clear 442 00:14:35,920 --> 00:14:39,920 so that's our uh tools selection 443 00:14:39,920 --> 00:14:41,760 now 444 00:14:41,760 --> 00:14:45,639 that's not okay 445 00:14:46,720 --> 00:14:49,440 okay um so about your target selection 446 00:14:49,440 --> 00:14:51,600 so your target selection is dependent on 447 00:14:51,600 --> 00:14:53,279 whether you want to spray or you want to 448 00:14:53,279 --> 00:14:56,480 spear fish so the pro and spraying is 449 00:14:56,480 --> 00:14:57,920 that you get a little bit of everybody 450 00:14:57,920 --> 00:14:59,680 in your company the con is you have to 451 00:14:59,680 --> 00:15:02,560 be cognizant of your sample size because 452 00:15:02,560 --> 00:15:04,959 if you are not and your sample size gets 453 00:15:04,959 --> 00:15:06,880 really big um during the analysis and 454 00:15:06,880 --> 00:15:08,240 reporting phase you're going to be 455 00:15:08,240 --> 00:15:10,000 bombarded with so much raw data it's 456 00:15:10,000 --> 00:15:12,160 going to drain you it's gonna burn you 457 00:15:12,160 --> 00:15:13,680 out so it's just something for you to be 458 00:15:13,680 --> 00:15:17,680 mindful of um the pro in spear phishing 459 00:15:17,680 --> 00:15:19,360 well kind of a con 460 00:15:19,360 --> 00:15:22,320 is that you kind of only get like a view 461 00:15:22,320 --> 00:15:24,560 a tunnel view of the specific function 462 00:15:24,560 --> 00:15:26,800 or department that you're testing but 463 00:15:26,800 --> 00:15:30,160 you actually get a really detailed um 464 00:15:30,160 --> 00:15:31,920 view and understanding of that specific 465 00:15:31,920 --> 00:15:34,320 function so the 466 00:15:34,320 --> 00:15:36,240 popular departments that we normally go 467 00:15:36,240 --> 00:15:38,480 for are finance marketing and sales 468 00:15:38,480 --> 00:15:40,720 marketing sales specifically because 469 00:15:40,720 --> 00:15:42,560 they are external facing so they're 470 00:15:42,560 --> 00:15:44,320 facing with a lot of emails from the 471 00:15:44,320 --> 00:15:47,279 outside including phishing emails um for 472 00:15:47,279 --> 00:15:50,880 me my favorite is new hires also because 473 00:15:50,880 --> 00:15:54,320 i do new hire security orientation so 474 00:15:54,320 --> 00:15:57,920 yeah um so i kind of like sew the seed 475 00:15:57,920 --> 00:16:01,199 of like an impending test i talk about 476 00:16:01,199 --> 00:16:02,720 a lot of security controls that we have 477 00:16:02,720 --> 00:16:04,240 in place including email security 478 00:16:04,240 --> 00:16:06,000 controls so it's a good way for me to 479 00:16:06,000 --> 00:16:08,000 kind of gauge that they comprehend 480 00:16:08,000 --> 00:16:09,920 everything that i just spewed at them in 481 00:16:09,920 --> 00:16:11,680 that moment like is there something that 482 00:16:11,680 --> 00:16:13,519 i should be doing more if our results 483 00:16:13,519 --> 00:16:15,440 come out a little bit 484 00:16:15,440 --> 00:16:18,480 shitty um 485 00:16:19,120 --> 00:16:21,600 so that's your target selection so you 486 00:16:21,600 --> 00:16:23,360 have your um 487 00:16:23,360 --> 00:16:25,279 tool setup domain set up you have your 488 00:16:25,279 --> 00:16:27,199 targets identified now it's about 489 00:16:27,199 --> 00:16:29,199 setting the campaign and again through 490 00:16:29,199 --> 00:16:31,040 go fish so 491 00:16:31,040 --> 00:16:33,279 why is that not showing up 492 00:16:33,279 --> 00:16:35,120 okay so you first have to set up your 493 00:16:35,120 --> 00:16:37,199 sending profile landing page email 494 00:16:37,199 --> 00:16:39,440 template and user group list before you 495 00:16:39,440 --> 00:16:41,440 can create and schedule your new cad 496 00:16:41,440 --> 00:16:43,759 page you have to do these correctly and 497 00:16:43,759 --> 00:16:45,120 you have to do them 498 00:16:45,120 --> 00:16:49,120 um fully um in terms of landing page the 499 00:16:49,120 --> 00:16:52,240 needful the bare minimum is a 404 error 500 00:16:52,240 --> 00:16:54,240 because you just essentially just want 501 00:16:54,240 --> 00:16:56,079 them to click and the more you do 502 00:16:56,079 --> 00:16:58,560 actually um the more your employees 503 00:16:58,560 --> 00:17:00,560 might feel like you're they're being 504 00:17:00,560 --> 00:17:03,120 deceded so if you like create a page 505 00:17:03,120 --> 00:17:04,319 saying like hey give me your card 506 00:17:04,319 --> 00:17:05,520 information give me your name your phone 507 00:17:05,520 --> 00:17:07,280 number just things like that at the end 508 00:17:07,280 --> 00:17:09,280 of the day you might get a more of a 509 00:17:09,280 --> 00:17:10,880 more of that irritation that kind of 510 00:17:10,880 --> 00:17:13,280 negative editing from your employees so 511 00:17:13,280 --> 00:17:15,919 all you need is a clicking rate that's 512 00:17:15,919 --> 00:17:17,760 the bare minimum you don't want to over 513 00:17:17,760 --> 00:17:20,000 complicate the work for yourself either 514 00:17:20,000 --> 00:17:22,559 so there's that so once everything's set 515 00:17:22,559 --> 00:17:24,640 up and then you're about to kick off the 516 00:17:24,640 --> 00:17:26,720 campaign something just like a little 517 00:17:26,720 --> 00:17:28,799 advice for you is that you should close 518 00:17:28,799 --> 00:17:30,559 out your campaign kind of end of day 519 00:17:30,559 --> 00:17:32,480 because there is no point in you 520 00:17:32,480 --> 00:17:34,320 dragging it out for days and days you're 521 00:17:34,320 --> 00:17:35,919 not going to see a significant spike in 522 00:17:35,919 --> 00:17:38,240 the reporting or clicking rate so it's 523 00:17:38,240 --> 00:17:39,760 best that you just close it out end of 524 00:17:39,760 --> 00:17:41,440 day and start doing your reporting 525 00:17:41,440 --> 00:17:44,000 analysis phase of it all 526 00:17:44,000 --> 00:17:44,960 okay 527 00:17:44,960 --> 00:17:47,200 so before you send out the fish there 528 00:17:47,200 --> 00:17:49,039 are a couple pre-engagement activities 529 00:17:49,039 --> 00:17:50,880 that you have to address 530 00:17:50,880 --> 00:17:52,640 um and first and foremost you should 531 00:17:52,640 --> 00:17:54,480 inform your stakeholders and this is 532 00:17:54,480 --> 00:17:56,480 important if you want that um continual 533 00:17:56,480 --> 00:17:57,440 buy-in 534 00:17:57,440 --> 00:18:00,160 um and also we do inform rit because we 535 00:18:00,160 --> 00:18:02,320 don't want them to handle responses and 536 00:18:02,320 --> 00:18:04,640 also our objective is not to 537 00:18:04,640 --> 00:18:07,520 test i team you should send test emails 538 00:18:07,520 --> 00:18:10,000 and you can do this through goldfish and 539 00:18:10,000 --> 00:18:11,600 you want to do this because if you have 540 00:18:11,600 --> 00:18:13,600 multiple email security controls in 541 00:18:13,600 --> 00:18:15,840 place i mean kudos to you you are doing 542 00:18:15,840 --> 00:18:18,400 the right things but 543 00:18:18,400 --> 00:18:20,400 likely your email your phishing emails 544 00:18:20,400 --> 00:18:22,240 are going to be quarantined by whatever 545 00:18:22,240 --> 00:18:24,320 mechanisms you're using so just make 546 00:18:24,320 --> 00:18:26,400 sure that you whitelist your domain and 547 00:18:26,400 --> 00:18:28,559 if your email has a link that you know 548 00:18:28,559 --> 00:18:30,720 is gonna be blocked by say save link 549 00:18:30,720 --> 00:18:33,440 just go to the default safe link um 550 00:18:33,440 --> 00:18:36,240 policy and just modify that and then uh 551 00:18:36,240 --> 00:18:37,919 revert it back when your campaign is 552 00:18:37,919 --> 00:18:39,039 over 553 00:18:39,039 --> 00:18:41,360 and finally just ensure that the 554 00:18:41,360 --> 00:18:43,679 appropriate ports are open so like on 555 00:18:43,679 --> 00:18:47,520 top of my head port um 80 and 443 keep 556 00:18:47,520 --> 00:18:49,200 them open and then 557 00:18:49,200 --> 00:18:50,880 do whatever you need to do after the 558 00:18:50,880 --> 00:18:52,880 campaign is over and edit all of this 559 00:18:52,880 --> 00:18:54,799 test it out as much as you need before 560 00:18:54,799 --> 00:18:56,240 you kick it off because you want to be 561 00:18:56,240 --> 00:18:57,760 able to do this right you want your 562 00:18:57,760 --> 00:18:59,679 targets to be getting the phishing email 563 00:18:59,679 --> 00:19:01,600 at the end of the day 564 00:19:01,600 --> 00:19:05,120 yeah um so you kick it off 565 00:19:05,120 --> 00:19:08,480 and then like what he's doing 566 00:19:08,480 --> 00:19:10,000 your targets are gonna beating up the 567 00:19:10,000 --> 00:19:11,840 fish you know numbing and munching and 568 00:19:11,840 --> 00:19:13,120 all that stuff 569 00:19:13,120 --> 00:19:15,120 um they're gonna be eating that up and 570 00:19:15,120 --> 00:19:16,799 at the end of the day you close that 571 00:19:16,799 --> 00:19:18,720 campaign and there are also some 572 00:19:18,720 --> 00:19:20,400 post-engagement activities that you have 573 00:19:20,400 --> 00:19:22,960 to address and 574 00:19:22,960 --> 00:19:24,720 one of the most important thing is you 575 00:19:24,720 --> 00:19:26,240 should send out the follow-up emails to 576 00:19:26,240 --> 00:19:28,720 your targets and you just have to be 577 00:19:28,720 --> 00:19:30,320 mindful of the tone of that email you 578 00:19:30,320 --> 00:19:32,160 want it to be encouraging you don't want 579 00:19:32,160 --> 00:19:33,600 it to be punitive 580 00:19:33,600 --> 00:19:36,480 um you don't want to place blame on them 581 00:19:36,480 --> 00:19:38,320 you don't want to do anything that will 582 00:19:38,320 --> 00:19:39,679 like foster any kind of negative 583 00:19:39,679 --> 00:19:41,039 attitude this is all 584 00:19:41,039 --> 00:19:42,960 like a learning aspect so you really 585 00:19:42,960 --> 00:19:43,919 should 586 00:19:43,919 --> 00:19:46,160 stress the learning aspect of this all 587 00:19:46,160 --> 00:19:48,400 and you should really emphasize the 588 00:19:48,400 --> 00:19:50,640 intent your mission in doing this 589 00:19:50,640 --> 00:19:52,160 exercise 590 00:19:52,160 --> 00:19:54,400 you should also kind of remind them on 591 00:19:54,400 --> 00:19:56,240 how to report their report any 592 00:19:56,240 --> 00:19:57,679 suspicious emails your reporting 593 00:19:57,679 --> 00:19:59,360 mechanisms 594 00:19:59,360 --> 00:20:02,960 and if you want to further promote 595 00:20:02,960 --> 00:20:04,159 the learning 596 00:20:04,159 --> 00:20:06,320 your employee learning infographics help 597 00:20:06,320 --> 00:20:08,880 a lot so this is an example of something 598 00:20:08,880 --> 00:20:10,799 that i created um so 599 00:20:10,799 --> 00:20:14,320 i impersonated um this person casey at 600 00:20:14,320 --> 00:20:16,400 our company it's a new hire training as 601 00:20:16,400 --> 00:20:19,520 you notice it's gmail it worked so again 602 00:20:19,520 --> 00:20:21,919 gmail works fine um and i just like 603 00:20:21,919 --> 00:20:23,360 highlight the 604 00:20:23,360 --> 00:20:26,320 tail signs and um the common red flags 605 00:20:26,320 --> 00:20:27,679 that you notice in phishing emails like 606 00:20:27,679 --> 00:20:30,240 urgency and i just send that out so they 607 00:20:30,240 --> 00:20:32,080 can kind of page that and 608 00:20:32,080 --> 00:20:33,840 like when they actually encounter real 609 00:20:33,840 --> 00:20:35,679 phishing examples of phishing emails in 610 00:20:35,679 --> 00:20:38,000 the future they know what warnings and 611 00:20:38,000 --> 00:20:39,760 signs to look for 612 00:20:39,760 --> 00:20:42,640 so after all this you're about 60 done 613 00:20:42,640 --> 00:20:44,320 now you have to go to the analysis and 614 00:20:44,320 --> 00:20:46,000 reporting phase so when you go to 615 00:20:46,000 --> 00:20:47,440 goldfish you're going to pull up the raw 616 00:20:47,440 --> 00:20:49,919 data it's gonna look daunting but good 617 00:20:49,919 --> 00:20:51,360 news you only have to focus on the 618 00:20:51,360 --> 00:20:54,000 identifier which is your email i 619 00:20:54,000 --> 00:20:55,440 redacted that for you know security 620 00:20:55,440 --> 00:20:58,640 purposes um and the action so under the 621 00:20:58,640 --> 00:21:00,960 message column you see uh click link and 622 00:21:00,960 --> 00:21:03,200 emailed open and you also want to focus 623 00:21:03,200 --> 00:21:05,679 on the ip addresses and the payload the 624 00:21:05,679 --> 00:21:07,360 ip addresses are important because it 625 00:21:07,360 --> 00:21:09,840 tells you whether um the action that was 626 00:21:09,840 --> 00:21:11,679 taken so the clicked link or emailed 627 00:21:11,679 --> 00:21:14,159 open was done by an actual person or by 628 00:21:14,159 --> 00:21:14,960 an 629 00:21:14,960 --> 00:21:18,159 automated isp so automated activity 630 00:21:18,159 --> 00:21:20,000 and i don't know about you but i don't 631 00:21:20,000 --> 00:21:21,600 know all the ips out there in the world 632 00:21:21,600 --> 00:21:24,000 i'm not i'm not an encyclopedia so i 633 00:21:24,000 --> 00:21:26,240 need to look them up too so the tools 634 00:21:26,240 --> 00:21:28,799 that i utilize are max mind so that is a 635 00:21:28,799 --> 00:21:32,480 free tool there's a 25 um limit like 25 636 00:21:32,480 --> 00:21:35,280 query limit um but if you are not if 637 00:21:35,280 --> 00:21:37,200 your target size is small and you're not 638 00:21:37,200 --> 00:21:39,200 really you don't really need to 639 00:21:39,200 --> 00:21:41,440 look things up maximize the way to go 640 00:21:41,440 --> 00:21:42,960 but for me i have a lot of targets that 641 00:21:42,960 --> 00:21:44,320 i have to go through ip addresses that i 642 00:21:44,320 --> 00:21:47,799 have to go through so i rely on info 643 00:21:47,799 --> 00:21:49,840 ipinfo.io which is 644 00:21:49,840 --> 00:21:51,840 a little bit of a subscription fee but 645 00:21:51,840 --> 00:21:52,960 it's not a lot 646 00:21:52,960 --> 00:21:55,120 and they're both very useful so 647 00:21:55,120 --> 00:21:56,960 leaving it up to you to decide what you 648 00:21:56,960 --> 00:21:59,919 want to use but anyways so if once you 649 00:21:59,919 --> 00:22:01,600 have an ip address you kind of want to 650 00:22:01,600 --> 00:22:03,840 confirm if it's by a real person or buy 651 00:22:03,840 --> 00:22:06,320 an automated um isp 652 00:22:06,320 --> 00:22:09,120 you plug that ip in one of these ip 653 00:22:09,120 --> 00:22:10,960 lookup tools and you'll get something 654 00:22:10,960 --> 00:22:12,880 that looks like that so on the left you 655 00:22:12,880 --> 00:22:15,200 see the ip address on the right you see 656 00:22:15,200 --> 00:22:19,039 the um the isp it identifies the isp so 657 00:22:19,039 --> 00:22:21,679 things like caller crossing amazon.com 658 00:22:21,679 --> 00:22:24,159 palo alto chester they're all automated 659 00:22:24,159 --> 00:22:26,799 isps so you know that when you go back 660 00:22:26,799 --> 00:22:28,960 you identify that isp you know that 661 00:22:28,960 --> 00:22:30,880 action whatever action that was taken 662 00:22:30,880 --> 00:22:32,799 it's not legitimate as in like it wasn't 663 00:22:32,799 --> 00:22:34,960 done by a real person so you can kind of 664 00:22:34,960 --> 00:22:37,520 hide that and not include that in your 665 00:22:37,520 --> 00:22:38,799 report 666 00:22:38,799 --> 00:22:41,520 but if it's coming from things like a t 667 00:22:41,520 --> 00:22:44,559 uh verizon comcast or the ip address of 668 00:22:44,559 --> 00:22:46,559 your own vpn you know that that's done 669 00:22:46,559 --> 00:22:49,039 by an actual person so if you identify 670 00:22:49,039 --> 00:22:50,559 that in your data 671 00:22:50,559 --> 00:22:52,559 you know that's done by a real person 672 00:22:52,559 --> 00:22:53,919 and that's something you should include 673 00:22:53,919 --> 00:22:55,520 in your report 674 00:22:55,520 --> 00:22:58,720 so that compiled data 675 00:22:58,720 --> 00:23:00,159 plus 676 00:23:00,159 --> 00:23:02,320 the data that you port that you pull 677 00:23:02,320 --> 00:23:04,400 from your reporting 678 00:23:04,400 --> 00:23:06,880 platform mechanism you use that both 679 00:23:06,880 --> 00:23:08,480 together to create a report that looks 680 00:23:08,480 --> 00:23:10,480 like this with the following categories 681 00:23:10,480 --> 00:23:14,000 so we want to optimize reporting rate um 682 00:23:14,000 --> 00:23:16,400 and no click so 683 00:23:16,400 --> 00:23:18,559 obviously we will really pay attention 684 00:23:18,559 --> 00:23:20,240 to the didn't click and reported rate 685 00:23:20,240 --> 00:23:22,880 but we also focus on the circles on the 686 00:23:22,880 --> 00:23:25,120 clicked and reported uh rate because 687 00:23:25,120 --> 00:23:27,200 that told you a company to use or are 688 00:23:27,200 --> 00:23:29,679 they emailing information security inbox 689 00:23:29,679 --> 00:23:32,720 or are they directly messaging you 690 00:23:32,720 --> 00:23:35,520 and if it's kind of like spread evenly 691 00:23:35,520 --> 00:23:37,200 across maybe you want to go back to your 692 00:23:37,200 --> 00:23:39,200 company and say hey guys 693 00:23:39,200 --> 00:23:41,279 use that uh report phishing button or 694 00:23:41,279 --> 00:23:42,320 hey guys 695 00:23:42,320 --> 00:23:44,159 use this function because this is what 696 00:23:44,159 --> 00:23:46,480 we use for our company um who responded 697 00:23:46,480 --> 00:23:48,840 to the sender so who 698 00:23:48,840 --> 00:23:52,080 actually took a step further clicked and 699 00:23:52,080 --> 00:23:53,840 responded to your email and said things 700 00:23:53,840 --> 00:23:56,559 like hey can open the email 701 00:23:56,559 --> 00:23:59,120 we can't open the link we send it to me 702 00:23:59,120 --> 00:24:02,480 again because these people not only they 703 00:24:02,480 --> 00:24:03,840 clicked that they took a step further 704 00:24:03,840 --> 00:24:05,919 and they opened that email and so there 705 00:24:05,919 --> 00:24:08,000 is some kind of risk involved in that 706 00:24:08,000 --> 00:24:09,760 you just want to make sure and keep a 707 00:24:09,760 --> 00:24:11,919 close eye on that population and make 708 00:24:11,919 --> 00:24:13,279 sure that they are you know 709 00:24:13,279 --> 00:24:14,799 understanding kind of the risk 710 00:24:14,799 --> 00:24:18,400 associated with this behavior um how 711 00:24:18,400 --> 00:24:19,919 quick was the report 712 00:24:19,919 --> 00:24:21,840 how quick was the first report that came 713 00:24:21,840 --> 00:24:24,559 in through your um reporting mechanism 714 00:24:24,559 --> 00:24:26,400 and again who clicked and reported this 715 00:24:26,400 --> 00:24:28,080 is important again because it tells you 716 00:24:28,080 --> 00:24:29,919 how much your function has been is 717 00:24:29,919 --> 00:24:32,240 trusted and finally were there any 718 00:24:32,240 --> 00:24:34,480 mentions in public forum so like 719 00:24:34,480 --> 00:24:37,200 in slack or any other direct messaging 720 00:24:37,200 --> 00:24:39,840 platform because this tells us who is 721 00:24:39,840 --> 00:24:41,520 being vigilant and how they are being 722 00:24:41,520 --> 00:24:43,600 vigilant and 723 00:24:43,600 --> 00:24:46,720 this is all important for us to 724 00:24:46,720 --> 00:24:48,640 engage and kind of see how we can 725 00:24:48,640 --> 00:24:52,000 reshape and improve our security program 726 00:24:52,000 --> 00:24:54,080 well i'm out of time so with that i'm 727 00:24:54,080 --> 00:24:55,679 giving it back to brian who is going to 728 00:24:55,679 --> 00:24:57,360 tie it in a nice foe and summarize 729 00:24:57,360 --> 00:24:59,039 everything 730 00:24:59,039 --> 00:25:01,039 i'm taking it home because we're a time 731 00:25:01,039 --> 00:25:02,880 so if there's one thing that y'all 732 00:25:02,880 --> 00:25:04,320 remember when you walk out of here it's 733 00:25:04,320 --> 00:25:06,400 that you can do this it's possible to 734 00:25:06,400 --> 00:25:08,799 run fishing campaigns without making 735 00:25:08,799 --> 00:25:10,559 enemies and irritating people it 736 00:25:10,559 --> 00:25:12,559 requires careful planning it requires a 737 00:25:12,559 --> 00:25:14,960 lot of empathy uh we got to get out of 738 00:25:14,960 --> 00:25:16,240 this mindset that people need to be 739 00:25:16,240 --> 00:25:18,080 punished that's not how people learn 740 00:25:18,080 --> 00:25:19,600 people can learn through empathy you're 741 00:25:19,600 --> 00:25:21,120 there you're their best friend you're 742 00:25:21,120 --> 00:25:23,200 their expert you literally exist for 743 00:25:23,200 --> 00:25:24,799 them 744 00:25:24,799 --> 00:25:26,159 so and you don't have to spend a lot of 745 00:25:26,159 --> 00:25:27,520 money you don't have to set up a lot of 746 00:25:27,520 --> 00:25:30,400 stuff we set up aws work mail in like 747 00:25:30,400 --> 00:25:32,240 under five minutes with a custom domain 748 00:25:32,240 --> 00:25:33,600 it's super easy 749 00:25:33,600 --> 00:25:35,360 quantitative and qualitative results 750 00:25:35,360 --> 00:25:36,559 matter 751 00:25:36,559 --> 00:25:38,799 but really what you want is to build an 752 00:25:38,799 --> 00:25:40,880 active engaged community that will 753 00:25:40,880 --> 00:25:42,159 actually like you and i know that 754 00:25:42,159 --> 00:25:44,000 everyone here can do it so thank you so 755 00:25:44,000 --> 00:25:45,279 much for the time today i know that 756 00:25:45,279 --> 00:25:46,720 we're at time 757 00:25:46,720 --> 00:25:48,880 it's so awesome to see like eyes and 758 00:25:48,880 --> 00:25:50,240 people in person and we're just very 759 00:25:50,240 --> 00:25:51,840 grateful to be here enjoy the rest of 760 00:25:51,840 --> 00:25:55,399 the con thank you