PerezBox

Tony Perez On Security, Business, And Life

  • Security
  • Business
  • Life
  • About
  • Contact

Feelings Have No Place in the World of Security

Published in Security on December 29, 2020

The quickest, and arguably most effective way, to compromise an organization is via social engineering. Social engineering in the digital sphere is almost always synonymous with some form of Phishing attack.

Phishing attacks, in it’s simplest form, is the basic act of luring a victim to some bait to achieve some outcome.

Think of the act of fishing. You attach a worm to your hook, and you cast it into the water. You wait, and eventually a hungry fish comes along and says, “hey, lookie here, dinner..”. They bite, and like magic, you have caught your fish.

The Phishing World

As security gets better, phishing becomes more important to bad actors. As physical networks disappear, and organizations move to the cloud, phishing is becoming more prominent.

The reason is simple, Phishing takes advantage of the one vulnerability that security professionals have struggled with since the beginning of the industry – the human element.

Phishing is often believed to come from emails, but that is only one medium. Phishing has evolved and can come from a myriad of other sources like social media and voice platforms as well.

The human vulnerability is not entirely the humans fault. Humans are creatures of habit, and technology companies have introduced habits that work counter to what we do in the security world.

To help illustrate the point, here are but a few of the things that contribute to why Phishing attacks are so effective:

  • A link, by design, is meant to be clicked on;
  • A file, by design, is meant to be opened;
  • Technology obfuscates sensitive information about where information is coming from, by design. The thinking from the biggest companies is, “don’t inundate the user with information they don’t care about”;
  • Technology allows us to leverage colors, styling and other elements to appeal to a users mind to encourage engagement (there are literally teams devoted to this form manipulation in companies of all sizes);

And now, there is a new handicap – don’t hurt your employees feelings.

Bad Actors Don’t Care About Feelings

Somewhere in the ridiculous world we live in, feelings have became part of the discussion as it pertains to keeping organizations safe.

We’re not talking about an employee being mistreated, being assaulted, or otherwise being treated less than they deserve. No, we’re talking about the offensiveness that comes with running a test that emulates a tactic a bad actor would take and an employee being offended by it’s “tone-deaf” nature.

For context, during Christmas, 2020, GoDaddy decided to run a test in which they offered a bonus in lieu of a holiday party. Here is what it read:

It was brilliant, and here is why:

  • It emulates an email that GoDaddy would have sent for other events;
  • It was crafted to take advantage of something that was most likely at the top of everyone’s mind – no Holiday party (something GoDaddy was once known for, and dear to everyone’s heart);
  • It indirectly appeals to the current state of affairs with the pandemic – “We can’t be together”;
  • It also appeals to the economic state of affairs – money is tight everywhere, and we want to make it better”;
  • The security team that put this together put themselves in the shoes of a bad actor – “what would they do?”;

I can appreciate the brilliance in this test.

Instead, what we focus on is that it was considered “tone-deaf” and feelings were hurt. Bad actors don’t care about your feelings, and as such, those that are charged with protecting a company, and it’s employees, cannot either.

The Hypocrisy is Deafening

Get hacked, and you will be blamed for failures in your strategy and team, all while getting limited funding and support. Work to avoid a hack, and you will be blamed for hurting feelings. Everyone will support the strategy, until the feeling are made public, then you’ll have to recant as if the strategy was flawed.

The irony of it all? Those whose feelings are hurt and whom the media latch onto like pariahs, are the ones being protected by these type of tests.

FYI, the last major compromise GoDaddy suffered in 2020 was by way of a Phishing attack.

In the end, we end up with another forced apology for something that shouldn’t even be a conversation. Feelings have no place in the world of security.


Tips to Protect Against Phishing Attacks

Per the Center for Internet Security, here are a few tips to help evolve your online habits and become more resilient against Phishing attacks (and tests):

  • Be cautious about all communications you receive. If it appears to be a phishing communication, do not respond. Delete it. You can also forward it to the Federal Trade Commission at spam@uce.gov.
  • Do not click on any links listed in the email message, and do not open any attachments contained in a suspicious email.
  • Do not enter personal information in a pop-up screen. Legitimate companies, agencies, and organizations don’t ask for personal information via pop-up screens.
  • Install a phishing filter on your email application and also on your web browser. These filters will not keep out all phishing messages, but they will reduce the number of phishing attempts.

Learn more about Phishing from the US Cybersecurity & Infrastructure Security Agency.

Category: Security Topics: Strategic Thinking

About Tony Perez

One of CleanBrowsing and NOC.org Founders. Formerly GoDaddy's General Manager (GM) for the Security Product Group. Responsible for the Sucuri brand, Certificate Authority (CA), Content Distribution Network (CDN), Website Application Firewall (WAF), Website Backups, Monitoring, and Incident Response products and services. The former CEO / Co-Founder of Sucuri and US Marine.

You can follow me on Twitter at @perezbox.

Tony Perez CEO Sucuri

About Tony Perez

I've spent the better part of the past 15 years dabbling in various technical industries, and these days my focus is website security and business. This blog, regardless of topic is a chronicle of my thoughts and life as I navigate those things that interest me the most.

  • Facebook
  • Twitter
  • LinkedIn
How To Block Porn

Search

Recent Posts On Security

Three Things that DNS Outages Teach Administrator

NOC Introduces a CDN. Yes, a CDN.

Feelings Have No Place in the World of Security

Unleashing the Power of Authoritative DNS

Content Filtering with CleanBrowsing

View All Security Posts

Security Posts By Topic

  • Desktop And Operating System Security
  • Drupal Security
  • End User Security
  • Intrusion Detection System (IDS)
  • Joomla Security
  • Log Management
  • OSSEC
  • Passwords And Identity Management
  • Security Tools And Technology
  • Speaking And Media
  • Vulnerabilities And Malware
  • Web Application Firewall
  • Web Hosting And Web Servers
  • Web And Information Security
  • WordPress Security
  • WordPress Plugins

Like what I have to say?

Subscribe to hear more...

I don't always have something to say, but when I do I will aim to make it insightful. Subscribe to hear my thoughts as I make them available.

PerezBox

  • Facebook
  • Twitter
  • LinkedIn

Copyright © 2022 Tony Perez, PerezBox. All Rights Reserved | Security | Privacy