4

I work as an IT contractor for a large insurance company in the UK.

Every so often, our security team will send a fake email around our office, to test that people can recognize and flag phishing/spam emails.

The problem is, in the 8 months I've worked for this company, every single time one of these phishing tests has been sent, somebody has warned the entire office within minutes of it being sent. This is usually a manager/team leader of some description who has access to the department mailing lists.

To me, this is irresponsible, and actually a pretty big security issue. My reasoning is that security have sent this test out expecting to receive accurate data back, which is being skewed by someone warning the entire office not to fall for the trick. On top of this, employees that might have fallen for the trick aren't learning anything. It's easy to sit and think "Oh yeah, I would have noticed that slightly different email address no problem!", when in practice quite a few people would definitely fall for the phishing attack, at least enough to open the email. We have even had an email praising our low percentage of failures, saying it was unexpectedly low.

I decided to question the latest person to warn everyone about this, and stated my reasons as above. This person is significantly high up in the business, perhaps on the level of an area/department manager. The response they gave was "I'm all about education, anon", they then proceeded to explain how this was like training a dog, and there needed to be positive as well as negative measures.

It's clear to me that this person is either unaware of the damage they could be doing, refusing to consider it, or are so arrogant that they believe they know better than an entire security department. Or they could just be interested in having a high pass rate for their department.

I am just a rank and file employee, and as a contractor my voice carries even less weight against someone with this level of seniority, and I'm worried this will reflect badly on me if I argue further with this person.

My question is:

  • Is this as big of an issue as I'm making it out to be?
  • Is the situation worth reporting to security? Both this manager's attitude towards security and the wider issue in general?

closed as off-topic by Mister Positive, scaaahu, Rory Alsop, Cronax, DarkCygnus Mar 1 '18 at 2:01

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    I don't think this is off-topic here, but you might get a better response over at Information Security. They can address whether the manager's actions invalidate your security test or not. – David K Feb 21 '18 at 15:35
  • 1
    Yes it is a big issue but it is not your problem. – paparazzo Feb 21 '18 at 17:16
  • Agree with @Paparazzi not your problem. – Mister Positive Feb 21 '18 at 18:16
  • somebody has warned the entire office Boy I'd be pissed off if I were you. Somebody better be able to explain why they waste company money by 1) making you waste your time 2) creating a huge liability – rath Feb 23 '18 at 9:25
  • to test that people can recognize and flag phishing/spam emails - what is the expected behaviour if they receive a real phishing mail? Should they not warn the entiere office? Should they instead only flag it to IT without telling anybody else? This seems to introduce unnecessary delays and increase the risk that someone replys to the phishing mail. It seems to me your process is flawed and you want to punish people that actually behave correctly - if an email looks fishy to me, I will warn all my colleagues as fast as possible to prevent harm. – Georg Patscheider Feb 28 at 10:01
9

DOCUMENT EVERYTHING

You are correct in your assessment of your being without power and influence. Therefore all you can do, and all you are required to do, is document vulnerabilities and inform your immediate supervisor of what you have found. Then, let it be while continuing to maintain your records so that if a security breach does occur you are not blamed.

If you were a full time, permanent employee, I'd say push this a bit more, but as a contractor, the only thing you'll accomplish is getting your contract cancelled.

DOCUMENT, ESCALATE, WITHDRAW

8

I think your reaction is inappropriate. The senior folks warning the junior folks is part of your organizational response to phishing emails. In the most common real-world scenario, a specific attack hits everyone it will reach in an organization within a fairly short time period; don’t you want the more savvy employees to warn the others then?

If you want to do a test of just the less IT-aware folks, then develop some sort of exclusion criteria, and exclude the “reporters” from your mailing. But I frankly don’t see the value.

  • 3
    This answer. The OPS mistake is to send the phishing test to everybody at once. It's unrealistic. Send it to a few people, then a few more a bit later. – DJClayworth Feb 28 '18 at 19:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.