Time to Stop Shaming Phishing Victims

It is time to stop the blaming and shaming of phishing victims. Granted, end users should know better than to click on random attachments, but crooks are getting better at crafting clever emails that can fool even experienced professionals. And that’s just half the problem.

Phishing Scams Becoming Harder to Spot

While professional phishing messages are improving in quality and are often indistinguishable from legitimate email, there is another issue: Since more users are checking their emails on mobile devices with smaller screens, phishing emails are getting even harder to spot.

Take the case of one phished email that brings up a site that appears very close to the Google Account page. It displays the following in a victim’s browser bar: data:text/html,https://accounts.google.com/ServiceLogin?service=mail

Note that the URL is preceded by a “data:text” label. This isn’t an ordinary URL, but a data URI, which enables a complete file to reside in the browser location bar. It is a clever way to embed a script without showing it. Wordfence warned users to carefully observe the browser bar and ensure that there isn’t anything preceding the HTTPS protocol phrase.

Shaming Phishing Victims Is Counterproductive

Shaming users for falling victim to one of these tricky phishing schemes is counterproductive because it creates a negative and unhelpful environment. Employees don’t want to feel ashamed for failing at their jobs.

“People are afraid of getting in trouble, and the last thing you want is for employees to hide it when they make a mistake,” one security researcher told Lifehacker Australia. Instead, IT leaders should encourage end users to report suspicious emails to the security department and offer rewards and incentives to promote good security practices.

The solution is more education, security awareness training and positive reinforcement. In some companies, IT departments and security operations team may be able to handle creating an ongoing training program catered to organizational needs. However, not all businesses have the resources, knowledge and bandwidth to do this and may instead turn to third parties for help. Many vendors offer these programs — the trick is finding one with a positive focus, such as KnowBe4’s Kevin Mitnick Security Awareness Training, the SANS Institute’s Securing the Human program or Wombat Security’s Anti-Phishing Training Suite.

As long as you eliminate the victim walk of shame from your security strategy, any of these programs can have a big impact.

Read this article and other cool ones at the source.

Source: Security Intelligence

Topics: Speaking Engagements, Global Ghost Team, Google Account, phishing victims, Wombat Security, data text label, Lifehacker Australia, mobile devices, SANS, Securing the Human, security awareness training, IT, KnowBe4, Anti Phishing Training Suite, phishing, Kevin Mitnick, malicious emails

Latest Posts

Kevin offers three excellent presentations, two are based on his best-selling books. His presentations are akin to technology magic shows that educate and inform while keeping people on the edge of their seats. He offers expert commentary on issues related to information security and increases “security awareness.”

Mitnick Security: Ransomware Awareness Training

Ransomware is a type of malware that prevents accessibility to either a single computer or an entire network until a ransom is paid. This can result i..

Read more ›

Mitnick Security: Phishing Awareness Training

Phishing emails are one of the most common social engineering techniques used by threat actors today due to such high success rates. About 3.4 billion..

Read more ›

Mitnick Security Training: QR Code Cybersecurity Test

Nearly 90 million smartphone users in the U.S. alone have used QR codes on their mobile devices. By 2025, that number is projected to grow to 100 mill..

Read more ›
tech-texture-bg