"fake" phishing mails from CST

Question

I work in the computer security team of my company and my team leader ask me to send "fake" phishing mails to my colleagues. The mails intended to lure them into clicking on the embedded links (the links lead to an informative webpage on phishing).

I am a bit puzzled to try to trap my colleagues. Is it ethically acceptable to trap my colleagues? Is it legal (for French laws for instance)?

Thank you

Answer 1

Yes, its ethically acceptable to "trap them," as long as you don't do it for your own win. If you send them to an informative page, it's fine.

If you send them to the real company login, but include like ?phish=true in the URL and then have logic on the server side to disable the account and then schedule the user for more education about phishing, then it's fine too.

What's unethical is if you send them to your own login page, even if you don't store or do anything with the details.

There is actually a business that engages in this, called "PhishMe". The company works this way:

• First, they will set up a reporting address for you, like fraud@yourcompany.com.
• Then, you will need to educate your users to report any suspected phishing to that address.

• Then PhishMe will send out fake phishing mail to your employees. If the employees click the link, then it will be registered that they didn't react correctly on phishing. They also have forms and such to see if the user enter sensitive data (but of course they discard it immediately).

  If they do nothing, it will be accepted as a good solution.

  If they report it to fraud@yourcompany.com, PhishMe will filter away the report (as they can identify that the phish mail was actually a fake educative phish) and then register that the user did a good thing of reporting it. They still forward all reports for genuine phishing mail sent by fraudsters to your real fraud reporting address.

Another thing you need to be aware of, especially if you use an external mail server, is that your fake phish could end up getting company servers blacklisted for phishing/spamming. Ensure the servers are set up to ignore such fake phish, and ensure you don't use any external contractors for running the mail servers. Also make sure the users do not forward the email to their Gmail account or such, by simply disabling the possibility to forward mail on the server side, and only allow IMAP/POP3 from internal network/VPN, to prevent fetching email from like Gmail. This prevents users from "reporting as spam" at such providers.

About legality, it wouldn't be illegal since its really not fake email actually, because "fake email" is email not written by the company, and mail written by a company is really not fake. It's the same thing as you cannot "fake your own signature", because then you are not faking it. And it could be shown that you have no malicious intent as you are redirecting them to an informative page about phishing.

Another important thing to consider is, obtain clear and written permission from company managers and such, that you have the company's full permission to do this, in case the company decides to do this to "get rid of you" by telling you to do things they then can report as crimes to the local authorities. It's the same effectively as someone giving an item to you for free, like "here, have it, its for free," and then going to the police and report you for theft, and you can't prove you got it for free. That's why papers are important.

However, when implementing such programs, it's important to allow the user to use his own signals to react on phishing. That's why you should preferably tell your mail server to insert a fake SPF validation header saying that SPF validation failed, for those fake phishing messages (and suppress the real SPF "passed" validation). Else the phishing mails will show up as genuine.

And you should also make sure other signs of the mail make it a phishing, so if the user uses tools to deduce if its phishing, it's important that these tools can react correctly and alert like it was a real phishing.

Answer 2

The general term for having your own people take the role of the "bad guys" in order to improve quality is Red Team, and every company that is serious about security does it. But there are a few rules to follow:

• Keep it professional
  These are company-sponsored attacks; the company is the target, not the individual. Do not attempt to collect personal data, passwords, or secrets.

• Keep the lawyers in the loop
  Your legal counsel is there to keep everything above-board and prevent things from getting out-of-hand and causing legal trouble. They set the rules, you follow those rules, everybody stays safe.

• Run post-mortem analyses on successful attacks
  The whole point is to make your company safer by finding and fixing weaknesses. If the attack that worked last week works again next week, then you haven't made progress. It's time to stop what you're doing and fix the problems. (NB: Your problems are your processes, not your people.)

• Shaming your employees doesn't help
  Pointing out the employee who clicked the phishing email this week does not prevent employees from falling for phishing. Even the most vigilant user can be fooled; it's human nature. You need to equip your users with sufficient technical controls and safeguards to help compensate for human fallibility.

• Make it a positive experience
  Recognize people for doing the right thing, not for doing the wrong thing. Competition can be helpful in keeping a topic present in people's minds, but you want recognition to center around success not failure.

• Get everyone involved
  Some of the most successful Red Team operations allow normal users to periodically rotate through the program and attack their co-workers in a safe and supervised environment. Getting a chance to be the attacker helps users better understand and appreciate the security measures that they have to live with. Further, if everyone is used to fending off and reporting attacks, it's much harder for a real attacker to go unnoticed.