Thousands of students and employees targeted by phishing attacks by email this year took the bait. Fortunately, they were not deceived by these scammers, but their own schools — in simulations that are designed to make them more adept in identifying real threats.
When the Ohio state University made him the first student-focused phishing attacks in January — a strategy also used in the corporate world — more than 18 percent of recipients clicked on the link. The University of Alabama focused on employees of Birmingham phishing campaign caught more than 7,000 people in March, or about a quarter of recipients.
Ohio state sophomore Ezequiel Herrera, who is proud that fast did not respond to messages that had been caught by surprise twice fake phishing emails. The first time, he said he was proud of his school takes this kind of educational action. The second time left him frustrated.
“I thought, ‘Wow, I’m really, really bad,” Herrera, 19, said with a smile. Since then, he said, he became more careful when viewing emails from unknown senders.
Faux phishing emails imitate messages about financial help, holidays, password reset and other sections, but contains elements of potential fraud, such as the universal greetings, requests for urgent action or for information, spelling errors, and from unfamiliar senders domain names. Recipients click the link in the email will be redirected to tips on good safety habits and how to determine and report actual attempts to steal passwords or other sensitive information.
“Phishing simulation helps people understand the role they play in the governance of security that it does not depend on their it support or support or whatever, they can blindly go forward,” said Helen Patton, Ohio state’s chief information security matters. “A lot of what makes the organization security is what happens between the individual and their keyboard or their phone.”
Patton refers to this as digital of vaccination, helping to protect people and the wider community of the campus against cyber attacks, which could cost a lot more than phishing simulation.
Just last month, us prosecutors accused a group of Iranians of hacking into computer systems around 320 universities in the U.S. and abroad, to steal billions of dollars in science and technology, which are then used by a state or sale for profit. Prosecutors said that the phishing email was used to target more than 100,000 professors, but they do not publicly identify those people or their schools.
Ohio used a phishing simulation for employees in 2016. The officials did not disclose the exact results for security reasons, but to say, the responses improved from the start of the round, when, for example, the message on the second floor printer has been chosen by the people in the room that wasn’t even the second floor.
In a hurried, tech-related culture, in which so many people sharing so much information at their fingertips on smartphones and other devices, said Patton, the battle is getting people to slow down.
Practical, hands-on training fake phishing was more effective compared than the slide shows, webinars or other common types of training that can get stale, said Joanna Grama, who runs the cybersecurity agenda in higher education technology Association EDUCAUSE.
The risk, of course, is that people feel cheated, so it is important that education be education, not punishment, Grama said.
In Alabama-Birmingham, one teacher condemns phishing modeling as a waste of time, but the majority of responses were positive, said and curt Carver, University Vice President for information technology, who recalls first hearing about the concept of phishing over a decade ago.
Some people report the message as suspicious and send other responses like “ha, you got me!” or “don’t get me this time!” Some, he said, have expressed interest in creating the game, wanting to evaluate how well they detect phishing attacks compared to other.
“They understand … they can be hero, they may be the person who helps to protect everyone else,” said Carver.
—
Find Kantele Franko on Twitter https://www.twitter.com/kantele10 and her work in https://bit.ly/2qEaebN.
Sourse: abcnews.go.com
