I work as an IT contractor for a large insurance company in the UK.
Every so often, our security team will send a fake email around our office, to test that people can recognize and flag phishing/spam emails.
The problem is, in the 8 months I've worked for this company, every single time one of these phishing tests has been sent, somebody has warned the entire office within minutes of it being sent. This is usually a manager/team leader of some description who has access to the department mailing lists.
To me, this is irresponsible, and actually a pretty big security issue. My reasoning is that security have sent this test out expecting to receive accurate data back, which is being skewed by someone warning the entire office not to fall for the trick. On top of this, employees that might have fallen for the trick aren't learning anything. It's easy to sit and think "Oh yeah, I would have noticed that slightly different email address no problem!", when in practice quite a few people would definitely fall for the phishing attack, at least enough to open the email. We have even had an email praising our low percentage of failures, saying it was unexpectedly low.
I decided to question the latest person to warn everyone about this, and stated my reasons as above. This person is significantly high up in the business, perhaps on the level of an area/department manager. The response they gave was "I'm all about education, anon", they then proceeded to explain how this was like training a dog, and there needed to be positive as well as negative measures.
It's clear to me that this person is either unaware of the damage they could be doing, refusing to consider it, or are so arrogant that they believe they know better than an entire security department. Or they could just be interested in having a high pass rate for their department.
I am just a rank and file employee, and as a contractor my voice carries even less weight against someone with this level of seniority, and I'm worried this will reflect badly on me if I argue further with this person.
My question is:
- Is this as big of an issue as I'm making it out to be?
- Is the situation worth reporting to security? Both this manager's attitude towards security and the wider issue in general?