3

I'm am looking into conducting a phishing campaign to gauge how susceptible my workplace is to phishing attacks. Part of this will involve guiding "duped" users to materials or resources that will help users learn how to spot and handle phishing attempts.

Would anyone happen to know of some good, preferably free, resources we could utilize? We already have a plan for conducting the campaign(i.e., sending the emails, tracking them, etc...), I'm looking for what to do once a person clicks through the email and now should be helped in learning about phishing and it's threats.

4
  • Assuming you have done a Google search, what materials do you like/no like?
    – schroeder
    Jul 7, 2014 at 18:54
  • Haven't actually found much too my liking so far. I know there are vendors that do phishing campaigns and provide the resources as part of that, but those are the costly options I'm currently steering away from. Safelight Security has something interesting, but haven't had a chance to dig into it yet. Was looking for something more substantive than a pdf or flier type material, but that seems to be the majority of free stuff I'm finding so far.
    – RedLee
    Jul 7, 2014 at 19:25
  • Try searching Sans "ouch"
    – Andy Boura
    Aug 6, 2014 at 21:13
  • Oh, and almost everyone is susceptible to phishing if it's targeted/sophisticated enough...education helps but I would be more concerned about proactive controls...
    – Andy Boura
    Aug 6, 2014 at 21:16

1 Answer 1

2

Full disclosure: I'm the owner of SelfPhish.com

When I was looking for examples of online sources, I found material was either skewed too much to the simplistic, or too much to the technical.

When it comes to phishing education, what you are looking to do is not simply to educate, but to change behaviors. More specifically, how to respond to 'triggers'. When an employee receives an email, what are they supposed to do. As you look for (or design your own program as many people do) material, keep an eye towards providing actionable steps on how to respond to any email. If you keep it to the behavioral level, then you may be able to bypass trying to teach technical concepts to your general population.

I could flood you with tons of available resources on the topic, but I would simply get you to look at the APWG as a source of public info that you can use.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .