Comic Strips

The one they use at my work is extra silly, as it adds an extra email header saying it’s coming from a phishing campaign

The Microsoft 365 admins at my workplace were doing something like this. It's got some sort of built-in phishing simulation functionality (I think it's this: https://learn.microsoft.com/en-us/defender-office-365/attack-simulation-training-simulations). The idea is that the recipient clicks a button in Outlook to report it as suspicious, and get a "congrats you did the right thing" notice.

However, it seems like IT security were unaware of the test, because they started blocking the emails and blackholed the domain the emails linked to (meaning it doesn't resolve on our network any more). They also reported the domain as phishing to some safe browsing vendor we use, which propagated into the blocklist Chrome uses. It was a shared domain Microsoft use for this training (it was one of the domains on this list: https://learn.microsoft.com/en-us/defender-office-365/attack-simulation-training-get-started?view=o365-worldwide) so Microsoft probably had to deal with un-blocking it...

Alternatively, over-report. Spelling mistake on an email from a colleague? Seems phishy to me. Email from a colleague with an attachment? Phishy! Unsolicited email from a client? Phishy! Email from 'social committee' sent to everyone in the team? Phishy!!!

except too many companies take that extra step of being annoying:

• you get a write up if you fall for the phishing
• you get a write up if you don’t fall for it but also fail to report it
• you get a write up if you don’t fall for it and do report it but don’t use the correct report form

My company is using some tool to generate those kinds of false scam emails every few weeks, so I created a rule in Outlook that if the header contains the word "gophish", it put a label "lol phishing" on it, so I know to just delete them...

I worked at a place that actually tracked whether you reported the fake phishing emails or not...

Plenty of companies will assign you extra training because you aren't reporting.

Ugh. I got one of them recently and clicking on it and hitting report as spam apparently registers as me having interacted with the email so I have to do the security course again.

Summer2024 Autumn2024 Spring2024 Winter2024

Are the most common passwords for regular employees. Update the year with the current or previous one.

Source: I was in IT.

P.s. if you have access to the physical location. Look for post-it notes under the keyboard.

"what is your password?"
"uh, it's just the letter A"

https://www.youtube.com/watch?v=uRGljemfwUE. A classic.