请输入您要查询的百科知识：

　

词条 Simulated phishing
释义

  1. Rationale

  2. Ethics

  3. Methods

  4. Frequency

  5. See also

  6. References

Simulated phishing or a phishing test is where deceptive emails, similar to malicious emails, are sent by an organisation to their own staff to gauge their response to phishing and similar email attacks. The emails themselves are often a form of training, but such testing is normally done in conjunction with prior training; and often followed up with more training elements. This is especially the case for those who "fail" by opening any email attachments, or clicking on any included weblinks - or if they were tricked into entering any credentials.

Rationale

There is wide acceptance within the IT security field that technical measures alone cannot stop all malicious email attacks, and that good training of staff is necessary.{{cn|date=September 2018}} Simulated phishing allows the direct measurement of staff compliance, and when run regularly, can measure progress in user behavior. Phishing simulation is recommended by various official agencies, who often provide guidelines for designing such policies.[1] Phishing simulations are sometime compared to fire drills in giving staff regular practice in correct behaviour.{{cn|date=September 2018}}

Ethics

Such campaigns need to be authorised at an appropriate level,[2] and carried out professionally.[3] If such a technique is used carelessly it may breach laws, attract law suits and antagonise or traumatise staff.

However, if employees are advised of a change to policy such that: "the company reserves the right to send deceptive "simulated phishing" email to staff from time to time to gauge staff security awareness and compliance", and training and guidance has been given in advance then such problems should not occur. Some organisations may choose to require users to give their consent by opting-in,[4] and others may allow staff the option to opt-out.[5]

The standard advice is that "failing' staff not be shamed in any way, but it is appropriate and reasonable to provide supportive followup training.[6][7][8]

Some techniques, which might be effective and in use by malicious actors, will be normally be avoided in simulated phishing for ethical or legal reasons. These would include emails with content likely to cause distress to the recipient,[3][6]

or the use of third party trademarks;[3][6] although it is also sometimes argued that this is covered by "fair use".[9]

Methods

Such testing can be done in a number of ways.

  • Many vendors offer web-hosted platforms to do this, and some provide limited free "test" campaigns.[10]
  • A wide range of freely-available open-source tools allow more technical organisations to host and run their own testing.[11][12][13]
  • Some email service now have such testing as a built-in option.[14][15]

Because organisations generally have a set of multi-layered defences in place to prevent actual malicious phishing, simulations will often require some whitelisting to be put in place at email gateways, anti-virus software and web proxies to allow email to reach user desktops and devices and to be acted upon.

Frequency

Most advice is that testing should be at done several times per year, to give staff practice in responding correctly, and to provide management feedback on the progress in staff identifying and reporting potentially dangerous email.

See also

  • Phishing
  • Fire drill

References

1. ^{{cite web |title=Designing Phishing Simulations |url=https://www.cpni.gov.uk/system/files/documents/51/d7/phishing_simulations_guide.pdf |website=Center for the Protection of National Infrastructure |accessdate=12 September 2018}}
2. ^{{cite news |last1=Kovacs |first1=Eduard |title=Attack on DNC Part of Simulated Phishing Test |url=https://www.securityweek.com/attack-dnc-part-simulated-phishing-test |accessdate=12 September 2018 |work=Security Week |date=23 August 2018}}
3. ^1 2 {{cite news |last1=Cheng |first1=Joey |title=Out-of-control Army phishing test results in new guidelines |url=https://defensesystems.com/articles/2014/03/18/army-phishing-email-test.aspx |accessdate=12 September 2018 |work=DefenseSystems |date=18 March 2014}}
4. ^{{cite web |title=Simulated Phishing |url=https://commons.lbl.gov/display/cpp/Simulated+Phishing |website=Berkeley Lab |accessdate=12 September 2018}}
5. ^{{cite web |title=Simulated Phishing Email Campaign |url=https://its.ucsc.edu/news/fake-phishing.html |publisher=UC Santa Cruz |accessdate=12 September 2018}}
6. ^1 2 {{cite web |last1=Prendergast |first1=Tom |title=Is all fair in simulated phishing? |url=https://www.csoonline.com/article/3237650/phishing/is-all-fair-in-simulated-phishing.html |website=www.csoonline.com |accessdate=9 September 2018}}
7. ^{{cite web |last1=Meijdam |first1=Katrien |title=Phishing as a Service: Designing an ethical way of mimicking targeted phishing attacks to train employees |url=https://repository.tudelft.nl/islandora/object/uuid:3134a851-2b40-4af1-896a-41a6ce7a5816/datastream/OBJ1/download |accessdate=10 September 2018}}
8. ^{{cite web |last1=R |first1=Kate |title=The Trouble with Phishing |url=https://www.ncsc.gov.uk/blog-post/trouble-phishing |website=National Cyber Security Centre |publisher=GCHQ |accessdate=12 September 2018}}
9. ^{{cite web |last1=Calarco |first1=Daniel |title=Stop Phishing with Bad Fake Bait |url=https://er.educause.edu/blogs/2017/6/stop-phishing-with-bad-fake-bait |publisher=EDUCAUSEreview |accessdate=12 September 2018}}
10. ^{{cite web |last1=Korolov |first1=Maria |title=10 companies that can help you fight phishing |url=https://www.csoonline.com/article/3066532/phishing/10-companies-that-can-help-you-fight-phishing.html |publisher=CSO Online |accessdate=12 September 2018}}
11. ^e.g GoPhish, King Phisher, The SocialEngineer Toolkit
12. ^{{cite news |last1=Pauli |first1=Darren |title=Go phish your own staff: Dev builds open-source fool-testing tool |url=https://www.theregister.co.uk/2016/02/04/no_more_excuses_dev_builds_dead_easy_open_source_antiphishing_app/ |accessdate=12 September 2018 |work=The Register |date=4 February 2016}}
13. ^{{cite web |title=Phishing campaign simulators |url=http://www.phishingcountermeasures.com/tools/22-phishing-campaign-simulators |website=Phishing Countermeasures |accessdate=12 September 2018}}
14. ^{{cite web |last1=Ghosh |first1=Debraj |title=GA of Attack Simulator For Office 365 Threat Intelligence |url=https://techcommunity.microsoft.com/t5/Security-Privacy-and-Compliance/GA-of-Attack-Simulator-For-Office-365-Threat-Intelligence/ba-p/183954 |website=Microsoft Tech Community |accessdate=12 September 2018}}
15. ^{{cite web |last1=Lardinois |first1=Frederic |title=Microsoft launches a phishing attack simulator and other security tools |url=https://techcrunch.com/2018/04/16/microsoft-launches-a-phishing-attack-simulator-and-other-security-tools/ |website=TechCrunch |accessdate=12 September 2018}}

3 : Cybercrime|Identity theft|Social engineering (computer security)
随便看

　

开放百科全书收录14589846条英语、德语、日语等多语种百科知识，基本涵盖了大多数领域的百科知识，是一部内容自由、开放的电子版国际百科全书。

　

Copyright © 2023 OENC.NET All Rights Reserved
京ICP备2021023879号 更新时间：2024/11/11 5:19:31