Safety online: anti-phishing stress test. Sustainability

Transcription

1 Safety online: anti-phishing stress test Sustainability 2012

2 AGENDA FRAMEWORK METHODOLOGY RESULS ATTACHMENTS

3 FRAMEWORK What is phishing? Phishing is based on the use of tools to collect information and personal data in a fraudulent way, via Internet, in particular through requests for information about logins and passwords, credit cards numbers, etc. The more recent practice used by phishers is the sending with links to pages with programs to install on your computer. These programs collect all the personal information used on internet and then sent it to someone that can make use of the same. With ICT massification and internet growth, phishers number is also increasing and their techniques are growing and being more diversified. Main goals of this study: I. Test, in a real environment, the users knowledge about phishing and risks exposure to phishing attacks; II. Processes and procedures identification that mitigate exposure risk.

4 FRAMEWORK How to avoid phishing: Do not send personal information by credit card number, usernames and passwords. Do not follow links from suspicious s or fill out any forms with information requests; Before following a suspicious link, always browse the entity identity through the research to check the link s veracity. Links are often camouflaged to collect the desired data. In case of doubt connect or forward the message to the sender and confirm its sending. Phishing s can be sent from false known contacts or known companies; Take care when access to sites - that require personal data - in public places.

5 AGENDA FRAMEWORK METHODOLOGY RESULTS ATTACHMENTS

6 THE PILOT UNIVERSE COVERED ALL THE BUSINESS AREAS OF SAPO S PORTAL, A COMPANY UNIT Characterization of the 300 employees 73% 37% 21% 25% 27% 1% 6% 5% 5% Women Men The anti-phishing stress test was made in partnership with Carnegie Mellon University (CMU).

7 METHODOLOGY IMPLEMENTED The universe of this stress test was divided in 3 groups, receiving the first 2 a phishing with an explicative/educational cartoon ; All 3 groups received 2 more phishing s which forward to false pages asking for personal data and passwords; Then, an was sent to all with a real link to test if and which users could distinguish the real and false phishing mails; Later was sent a small survey for the phishing stress test evaluation, with the aim of gathering feedback and improvement suggestions for future actions. The project ended with a training session about phishing and security rules, near the collaborators who have provided their personal data in the stress test A cartoon was sent with phishing training Then were sent a Phishing s In the end, was sent a survey to gather feedback A training session was made to whom provided personnal data

8 AGENDA FRAMEWORK METHODOLOGY RESULTS ATTACHMENTS

9 CONCLUSIONS AND RESULTS From the 300 employees who participated in the stress test: 41% opened the cartoon. 25% provided their username and password. The recurrent training and awareness it s crucial to prevent and minimise phishing risks. Opening rates of phishing s by function: % colaboradores 53% 1% 0% 29% 6% 5% 5% 21% 30% 37% 25% 18% 18% After this stress test, it was given a more indepth training on phishing and security rules in the use of corporate to the 25% of the employees who have provided their personal data. Phishing sent rate Phishing open rate

10 AGENDA FRAMEWORK METHODOLOGY RESULTS ATTACHMENTS

11 CARTOON SENT TO THE EMPLOYEES I can create s that look like the ones that companies send. - I can creat a false that looks like a real one. - Then, I alert the users to an urgent message. - I add a link that looks like its redirecting to a bookstore, but instead, send people to my website where I can still their personnal information. Your account will be suspended if you don t update your personnal data. This looks professional! I will send it to lots of people. The victim It s better to click on this link and update my information Look for a Costumer Care Service Never click in links inside s Never give personnal information by Write on the browser the site s true name Be attention to suspicious sites Tks Phishguru! I won t let phishers still my identity again.