There are just as many coworkers falling for the same traps as higher ups. That’s why everyone needs to do cybersecurity trainings year whatever.
It’s the just higher ups that get put in media.
Could they perhaps make the training better than because the trick emails our IT departments send out are super obvious.
Our emails are actually really good.
Eg. some are nearly identical to our service now emails. Except with the obvious tell tale signs of time criticality, from addresses, etc. They also vary a lot.
We get them quite often and we get timely feedback from them. Even I’ve fallen for one, and I work in IT. Well… clicked a link, but havent fed any details beyond that. But I show up in the stats!So please give that feedback to your IT department.
I know it’s always them doing checks , because otherwise, it would br wrttn like tise . no one ever checks their spelling innthis compney Andy More.,
You’re right… send honey my way so i can do some training.
To be fair with high profile target like huang, whatever training material will be oudated compared to honey pot prepared in real life.
Pretty sure this technique will continue to work for millennia.
The rules don’t apply to the rich, more news at 11.
Management never goes to training
And is almost never subject to the same rules as regular employees, despite being a much higher-profile target.
I got this email from [email protected] for an order of 10,000 chips. It’s probably legit.
Does it have any pictures attached? And make sure to download and run any programs.
Chin Esespy is a lovely lady.
Same as it ever was. The uppers fuck up and labour has to do ethics and security training.
I’ve literally just had to do environmental commitments training. This from a company that has recently changed all our email addresses from @company.com to @company.ai
Apparently they’re going to hit zero carbon emissions by 2050, I’m sure they will hit this ambitious target.
I recently received an email from the office of Marco Rubio reminding me of the importance of ethical behavior as a government employee. My eyes couldn’t have rolled back further in my head when I read that.
We have like 8-factor authentication. VPN, Yubikeys, auth apps, Face ID. I swear upper management does not have to do all this bullshit.
I also recently had to take a mandatory training on insider threats. Apparently being good at your job and also complaining about your job are two signs of an insider threat. Both of those apply to me, so I’m wondering if I should report myself as a possible insider threat. It doesn’t seem as fun as fucking a Chinese spy though.
Edit: also being bad at your job makes you an insider threat. So I guess you just have to be entirely mediocre, not too good, not too bad. Do just enough to get by, but don’t do too much. Or too little. Any outlier is an insider threat. Conform. Don’t be different.
Edit: also being bad at your job makes you an insider threat. So I guess you just have to be entirely mediocre, not too good, not too bad. Do just enough to get by, but don’t do too much. Or too little. Any outlier is an insider threat. Conform. Don’t be different.
This immediately reminded me of “Snow Crash”:
Y.T.'s mom pulls up the new memo, checks the time, and starts reading it. The estimated reading time is 15.62 minutes. Later, when Marietta does her end-of-day statistical roundup, sitting in her private office at 9:00 P.M., she will see the name of each employee and next to it, the amount of time spent reading this memo…
Y.T.'s mom decides to spend between fourteen and fifteen minutes reading the memo. It’s better for younger workers to spend too long, to show that they’re careful, not cocky. It’s better for older workers to go a little fast, to show good management potential. She’s pushing forty. She scans through the memo, hitting the Page Down button at reasonably regular intervals, occasionally paging back up to pretend to reread some earlier section. The computer is going to notice all this. It approves of rereading. It’s a small thing, but over a decade or so this stuff really shows up on your work-habits summary.
I was also going to mention this, and since I took the time to dredge up the pages in question here is the chart of possible reading times for everyone’s entertainment:
Less than 10 min. Time for an employee conference and possible attitude counseling.
10-14 min. Keep an eye on this employee; may be developing slipshod attittide.
14-15.61 min. Employee is an efficient worker, may sometimes miss important details.
Exactly 15.62 min. Smartass. Needs attitude counseling.
15.63-16 min. Asswipe. Not to be trusted.
16-18 min. Employee is a methodical worker, may sometimes get hung upon minor details.
More than 18 min. Check the security videotape, see just what this employee was up to (e.g., possible unauthorized restroom break).
Notice, of course, that the only winning move is not to play. As usual this is all eerily prescient, with the only quaint thing about all of this is that Stephenson apparently thought that surveillance camera video would still be stored on tape in the future.
ICE buys 3 or 4 robot dogs, and it begins:
“As part of Mr. Lee’s good neighbor policy, all Rat Things are programmed never to break the sound barrier in a populated area. But Fido’s in too much of a hurry to worry about the good neighbor policy. Jack the sound barrier. Bring the noise.”
It doesn’t seem as fun as fucking a Chinese spy though.
Well… no. You’d be fucking Jensen Huang in this scenario
They do by default, but if they bitch they get exceptions. Because they are in charge.
Everyone inside your company is an insider threat. Just like everyone outside of it is an outside threat. The point is to ID/flag people who are are disproportionately more risky than the baseline standard of risk. The FedEx guy making regular deliveries isn’t a flag, but if if he shows up at 2am and hangs out for an hour, yeah that’s weird and you should investigate that.
In fairness, “training” is usually a 20 minute PowerPoint presentation of Goofus and Galiant.
I worked for a tech giant that is a homonym of Sysco. The mandatory security training videos were I shit you not animated cartoon animals. I would be deeply concerned about security flaws in their products, except that I never encountered anyone there that had anything whatsoever to do with their actual products, nor did I encounter anyone who themselves had ever encountered anyone that had anything whatsoever to do with their actual products. This abstraction from the product line was actually a common topic of conversation there among the employees.
The abstraction of everything is why everything fucking sucks now!
“Hey, it worked for the Manhattan Project!”
— Management book advice, probably.
The Manhattan Project sucked pretty bad on the receiving end, so that tracks
I would have said “Rhymes with Disco”, but other than that I definitely very the vibe.
I presented a 45-minute security training presentation to my company of 35 people. Boring, right? I practiced for almost a year, though I’m not afraid to speak in front of a group, I wanted it right.
Management brought in good food and had everyone attend. We all but shut down for this. Did I mention I’m not afraid? I was scared shitless.
I left 15-minutes for questions and we ran into 30. Everyone was engaged! One of the wildest things I’ve pulled off in my IT career.
Maybe I should update and make a living offering my little class. Hmmm…
Some companies are just as ethically bankrupt all the way down to the mailroom.
Once, I worked at a place that had, and I kid you not: “Ethics awareness training.”
Said presentation had a few slides dedicated to mandatory legal matters and that was it. Ethics? Training? Awareness? Nevermind all that, did you know that we’ve always had Eurasia as a loyal customer? I didn’t stick around for very long.
The training is not for you. The training is to protect the company.
If anything ever happens that results in some kind of legal action, the company can say they gave the employee the training and the employee successfully completed the training, therefore we did all we could to prevent this and we are not liable. So then it all falls on you.
I took a very similar presentation from the shadiest company I was ever employed by, specifically that “gifts and other favors” are generally guidelines to be followed by local customs. I.e. bribe away as long as you aren’t in the United States. Weird as fuck for a company that solely does commerce in the United States to have murky guidance on this very clear issue.
My role here was very brief, they hired me for a licensed role and then paid me as a customer service rep, so I quit immediately after my first paycheck was about $3,000 short.
Have you heard of ethics?
Not yet. Thanks for making me aware of them!
If the leaders don’t take accountability or ethics seriously, why should the employees?
because they can get fired. the leaders/owners can’t.
“Do as I say, not as I do”
“Do as I say, not as I’ve done.”
Do as I say, not as I do!
weak link
Backdoor penetration test
Deep penetration testing all his ports
“I’ll suck your dick if you click this link.” Has a different ring to it.
Dang, IT attack simulations are getting intense.
Love me some Swordfish
It’s so dumb it’s charming. :)
I’ve been wondering if I should watch it again. All I remember is the explosive hostages, this scene, and topless Halle Berry. I know I rocked the soundtrack for a good while after it came out too.
I noped out at the “15 screens on poles hacker station” or whatever shit there was in it.
The movie was too stupid to pretend it was serious.
Why is my company’s cybersecurity training limited to simulated phishing emails and online courses?
Maybe next year’s cybersecurity budget should include some for hot-looking models (of every gender).
Penetration testing just got another meaning
And additional threat layers.
And those added layers actually have the benifit of making boundary traversal more difficult.
Training failed successfully.
IT security here. We tried, the CFO keeps denying our requests.
c-suite doesn’t take those trainings. typically they will get all sorts of exceptions from IT too, because they are in charge.
Only the peon workers get secured/locked down IT stuff.
also hot babes are not going to bonk you for your company secrets unless you’re in executive management.
also hot babes are not going to bonk you for your company secrets unless you’re in executive management.
or at least have access to some spicy shit in your job.
Yeah if someone is more attracted to you for you being an engineer instead of less you need to watch out
I have to wonder though, do those types even know how to get access to source code or data? Seems like the grunts would have better access to that. Or maybe they are googling “what is git clone”, “how to run sql query”?
Doesn’t matter if they know how to, what matters is they have access. The person that uses their access to steal stuff certainly will know how to do it.
Figure out beforehand it’s happening an play the wildest game of gay chicken the world has ever known.
Some things never change
Shades of Bezos and his dick pic scandal
someone that looks like that, I’m taking them to pound town.
he’s so old and frail, it doesn’t even look like he could fight back.
Something something you had me in the first half
Gotta deploy the “ugly” test in all such matters:
Would this situation be sus if the other party was unattractive to me?
You would not believe how many things this filters out. Sales, advertising, cons, youtube videos, instragram, tiktok nonsense, the list goes on.
It would be less suss if they weren’t attractive, or at least anywhere near his own age. (Idk how old she is. Dont flame me if she’s 50)
Hanging out with grandpa.
To be fair, I’d fall for this too. Zero chance I’m turning her down
While being very old and married? Okay i guess
Not sure if you are making an argument for or against?
These people never feel to old for shit like this.
I mean if they’re into it it’s one thing. If the consent from everyone isn’t there (in this case the wife) then that’s where it gets icky.
There’s hooking up and then there’s hooking up with someone you’re in business with and helping her do illegal shit at the risk of your job.
With a golden parachute worth hundreds of millions, I’d be risking my job everyday.
Golden parachutes for golden showers.
'Tis the
seasontreason
Could’ve been me tbh
That’s you? You must be hot. Take off your dumb jacket, it is not really the weather for it with all the global warming you are proliferating.
CEOs are the most targeted, and the least likely to doubt their own decisions.
Fortunately, I am far too ugly and too poor to be a security risk.
EDIT: I am secure in my ugliness and poverty.
You can be ugly and poor and a security risk. If you are insecure enough and lonely enough to fall for the honey pot then out goes the security.
If you are secure enough in your ugliness and too busy eeking out an existence then a honey pot won’t work because you know their interest is your body of work not your actual body.
I’m giving up on c-sec. I don’t want to play with swiss cheese for the rest of my life unless it’s on a raklet.
This isca sacrifice executives are always willing to make.
