{"id":18144,"date":"2022-02-02T11:12:45","date_gmt":"2022-02-02T19:12:45","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2022\/02\/02\/news-11877\/"},"modified":"2022-02-02T11:12:45","modified_gmt":"2022-02-02T19:12:45","slug":"news-11877","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2022\/02\/02\/news-11877\/","title":{"rendered":"How a few PhD students revealed that phishing trainings might just not work: Lock and Code S03E03"},"content":{"rendered":"

Credit to Author: Malwarebytes Labs| Date: Mon, 31 Jan 2022 17:06:00 +0000<\/strong><\/p>\n

You’ve likely fallen for it before\u2014a simulated test sent by your own company to determine whether or not its employees are vulnerable to one of the most pernicious online threats today: Phishing. <\/p>\n

Phishing has evolved in recent history, and as scammers have rolled out increasingly clever\u2014and increasingly complex\u2014phishing lures, companies have had to respond with increasingly better defenses. Most employees at large companies have a phishing “reporting” button that is embedded directly into their email client, and nearly just as many employees might have a phishing email detection system integrated into their email client, so that when a “fishy” email comes through (sorry), they are warned with a small notification at the top of the email. <\/p>\n

But one of the primary defenses used today by countless companies is the practice called “contextual” or “embedded” training, and it’s a practice that, as we learn today on the Malwarebytes podcast Lock and Code with host David Ruiz, might not work. <\/p>\n

It could be a little worse than that, actually\u2014this practice could make things worse<\/em>. <\/p>\n

That’s one interpretation coming out of a 15-month long study run by several PhD candidates at the ETH Zurich university in Switzerland. By working with a company of tens of thousands of employees, these researchers were able to test what phishing defenses actually provided the best results, and after experimenting with embedded and contextual training in a voluntary format, they learned that the phishing resilience of those test subjects actually diminished. <\/p>\n

Daniele Lain, who helped conduct the phishing research, told us: <\/p>\n

\n

“What we saw is that, very interestingly, if you do it like this\u2014when you get training appearing when you fall for simulated emails\u2014somehow it becomes much more likely that you actually fall for the subsequent phishing attempts.”<\/p>\n

Daniele Lain<\/cite><\/p><\/blockquote>\n

To say it’s a surprise is an understatement. <\/p>\n

Tune in to hear all this and more on this week\u2019s Lock and Code podcast by Malwarebytes Labs.<\/p>\n

\n