My company sends honeypot phishing email; should I automatically junk them?

Question

My company sends honeypot phishing emails from within our organization in Microsoft Outlook. e.g. hr@mycompanyname.com , ithelpdesk@mycompanyname.com , etc. I fell to one of these in a lapse of judgment while working late (I clicked a link in a honeypot email, hr@mycompanyname.com asking me to fill out an HR form, which told me to do some remedial security training). Now I want to block that bad email, so as to not fall for any more of them from that source. I found that I could not block the email as it was from within my organization (it's some outlook admin setting I think).

However I may be able to set certain senders be sent to junk through the "rules" setting, as to save myself time/attention or possible falling for any more traps.

I would consider a fairly normal and reasonable reaction to phishing emails to be to block the sender and delete the email.

Would automatically sending emails from known honeypot addresses from within my company to junk automatically be a bad idea?

I feel it would be a bad idea for the company to use previous honeypot email addresses on legitimate emails for important information. I would also expect that important information can be escalated beyond email in person, or through work phone or other channels of communication (company instant messaging, company HR system, etc) The company is somewhat small ~100 people.

I know legitimate email addresses belonging to the company can be compromised and bad stuff sent through them. Thus always constant vigilance is important regardless of sender, and I'm not practicing my "security mindfulness" if I just block my known encountered honeypots, because I'm not playing the game. However with my knowledge and due diligence of these appearing to be dedicated honeypot email addresses (never/not used for anything else), I feel blocking known dedicated honeypot email addresses serves to benefit myself and the company's interests (letting me just work).

Answer 1

Would automatically sending emails from known honeypot addresses from within my company to junk automatically be a bad idea?

I don't think it's a good idea...

First, one should not have to block emails coming from your own company, as you never know when one will have relevant or important information that needs your attention. If you start blocking company emails, you may miss one that could be important and get you in trouble.

Now, with all due respect, I think you are missing the point here... you say you "fell" for a security test/check coming from your HR email, by attempting to fill forms online or doing some insecure action, and thus gave you some security training...

Blocking this email will not solve the core problem, as it will not help you learn from this nor undo the (simulated) threat you opened and fell for. This is why taking this approach would be ineffective, at best, or even result in you missing relevant information coming from within your company.

The best you can do is to learn from all this situation. Try to be more aware of the emails you get, both from your company and from outside, so you can avoid falling into simulated or real traps seeking to compromise your information. Fortunately for you this time it was simulated...

Answer 2

Nearly every company has this scheme set up. Where they send fake phishing emails then see how many clicks on links or attachments. These generally take you to a training page or flag your manager.

With that said at my company I simply forward it as an attachment to the spam account. It's actually favorable behavior by the company. I even send them emails from high CEO who sends me a survey monkey link which I consider junk as well. It doesn't sound like bad behavior to me, and should be considered good behavior to block known aliases of things you know are spam. I would take it a step further and email every single one of them to the spam account your company has if they set one up.

Edit: After re-reading your question I realize you may have clicked on a spam email. You should go ahead and do the training to comply then in the future, forward such emails to the spam alias for investigation as well as deleting it/report to spam. You shouldn't treat it as a big deal and simply learn from it. Never click on links in emails and never open attachments.

Answer 3

Thus always constant vigilance is important regardless of sender, and I'm not practicing my "security mindfulness" if I just block my known encountered honeypots.

Exactly. Your strategy is unwise because you are denying yourself the opportunity to learn the types of emails and strategies used by potential real cybercriminals. As someone who works in cybersecurity profession, I have seen how subtle and advanced phishing attempts have become such as by substituting lookalike characters that are easy to confuse (0 vs O , l vs 1 etc).

In the past at my company, I have assisted management in designing phishing / social engineering defense strategies using simulated malicious emails containing website links with subtle differences such as the examples names above, compared to legitimate websites and results have been telling. Whether its targeted attacks (spear phishing / whaling) or general attacks, the failure rate was almost always inversely correlated to the amount of end user education and awareness. Successful phishing scams rely on the ignorance of the end user, making awareness training essential - section 6.4. Take the training opportunity offered by your company seriously.

The answer from @DarkCygnus rightly states to be more aware the types of email you receive. While you have not asked for this, there are certain characteristics of emails that more often than not tells you that the email is malicious. However, by no means should this list be interpreted absolutely or exhaustively. The answers to this question from the Information Security SE site lists other common characteristics of phishing emails.

• Emails with wording indicating urgent action is required or threatening negative action if not responded to in a certain amount of time. E.g: IMMEDIATE , URGENT etc.

• Emails sent with lots of grammatical or spelling errors

• Emails requesting you to send money or confirm your sensitive information such as passwords

• Emails sent at unusual times of the day