• rants_unnecessarily@piefed.socialEnglish
    9·
    6 hours ago

    There are just as many coworkers falling for the same traps as higher ups. That’s why everyone needs to do cybersecurity trainings year whatever.

    It’s the just higher ups that get put in media.

    • Echo Dot@feddit.uk
      2·
      1 hour ago

      Could they perhaps make the training better than because the trick emails our IT departments send out are super obvious.

      • rants_unnecessarily@piefed.socialEnglish
        1·
        1 hour ago

        Our emails are actually really good.
        Eg. some are nearly identical to our service now emails. Except with the obvious tell tale signs of time criticality, from addresses, etc. They also vary a lot.
        We get them quite often and we get timely feedback from them. Even I’ve fallen for one, and I work in IT. Well… clicked a link, but havent fed any details beyond that. But I show up in the stats!

        So please give that feedback to your IT department.

  • Masuta@thelemmy.clubEnglish
    11·
    10 hours ago

    To be fair with high profile target like huang, whatever training material will be oudated compared to honey pot prepared in real life.

    • phx@lemmy.world
      13·
      14 hours ago

      And is almost never subject to the same rules as regular employees, despite being a much higher-profile target.

    • Echo Dot@feddit.uk
      1·
      1 hour ago

      I’ve literally just had to do environmental commitments training. This from a company that has recently changed all our email addresses from @company.com to @company.ai

      Apparently they’re going to hit zero carbon emissions by 2050, I’m sure they will hit this ambitious target.

    • darkdemize@sh.itjust.works
      118·
      23 hours ago

      I recently received an email from the office of Marco Rubio reminding me of the importance of ethical behavior as a government employee. My eyes couldn’t have rolled back further in my head when I read that.

    • jaybone@lemmy.zipEnglish
      56·
      22 hours ago

      We have like 8-factor authentication. VPN, Yubikeys, auth apps, Face ID. I swear upper management does not have to do all this bullshit.

      I also recently had to take a mandatory training on insider threats. Apparently being good at your job and also complaining about your job are two signs of an insider threat. Both of those apply to me, so I’m wondering if I should report myself as a possible insider threat. It doesn’t seem as fun as fucking a Chinese spy though.

      Edit: also being bad at your job makes you an insider threat. So I guess you just have to be entirely mediocre, not too good, not too bad. Do just enough to get by, but don’t do too much. Or too little. Any outlier is an insider threat. Conform. Don’t be different.

      • loweffortname@lemmy.blahaj.zoneEnglish
        14·
        16 hours ago

        Edit: also being bad at your job makes you an insider threat. So I guess you just have to be entirely mediocre, not too good, not too bad. Do just enough to get by, but don’t do too much. Or too little. Any outlier is an insider threat. Conform. Don’t be different.

        This immediately reminded me of “Snow Crash”:

        Y.T.'s mom pulls up the new memo, checks the time, and starts reading it. The estimated reading time is 15.62 minutes. Later, when Marietta does her end-of-day statistical roundup, sitting in her private office at 9:00 P.M., she will see the name of each employee and next to it, the amount of time spent reading this memo…

        Y.T.'s mom decides to spend between fourteen and fifteen minutes reading the memo. It’s better for younger workers to spend too long, to show that they’re careful, not cocky. It’s better for older workers to go a little fast, to show good management potential. She’s pushing forty. She scans through the memo, hitting the Page Down button at reasonably regular intervals, occasionally paging back up to pretend to reread some earlier section. The computer is going to notice all this. It approves of rereading. It’s a small thing, but over a decade or so this stuff really shows up on your work-habits summary.

        • dual_sport_dork 🐧🗡️@lemmy.world
          9·
          3 hours ago

          I was also going to mention this, and since I took the time to dredge up the pages in question here is the chart of possible reading times for everyone’s entertainment:

          Less than 10 min. Time for an employee conference and possible attitude counseling.

          10-14 min. Keep an eye on this employee; may be developing slipshod attittide.

          14-15.61 min. Employee is an efficient worker, may sometimes miss important details.

          Exactly 15.62 min. Smartass. Needs attitude counseling.

          15.63-16 min. Asswipe. Not to be trusted.

          16-18 min. Employee is a methodical worker, may sometimes get hung upon minor details.

          More than 18 min. Check the security videotape, see just what this employee was up to (e.g., possible unauthorized restroom break).

          Notice, of course, that the only winning move is not to play. As usual this is all eerily prescient, with the only quaint thing about all of this is that Stephenson apparently thought that surveillance camera video would still be stored on tape in the future.

        • shalafi@lemmy.worldEnglish
          6·
          15 hours ago

          ICE buys 3 or 4 robot dogs, and it begins:

          “As part of Mr. Lee’s good neighbor policy, all Rat Things are programmed never to break the sound barrier in a populated area. But Fido’s in too much of a hurry to worry about the good neighbor policy. Jack the sound barrier. Bring the noise.”

      • UnderpantsWeevil@lemmy.worldEnglish
        18·
        20 hours ago

        It doesn’t seem as fun as fucking a Chinese spy though.

        Well… no. You’d be fucking Jensen Huang in this scenario

      • TubularTittyFrog@lemmy.worldEnglish
        4·
        20 hours ago

        They do by default, but if they bitch they get exceptions. Because they are in charge.

        Everyone inside your company is an insider threat. Just like everyone outside of it is an outside threat. The point is to ID/flag people who are are disproportionately more risky than the baseline standard of risk. The FedEx guy making regular deliveries isn’t a flag, but if if he shows up at 2am and hangs out for an hour, yeah that’s weird and you should investigate that.

      • shalafi@lemmy.worldEnglish
        101·
        16 hours ago

        I presented a 45-minute security training presentation to my company of 35 people. Boring, right? I practiced for almost a year, though I’m not afraid to speak in front of a group, I wanted it right.

        Management brought in good food and had everyone attend. We all but shut down for this. Did I mention I’m not afraid? I was scared shitless.

        I left 15-minutes for questions and we ran into 30. Everyone was engaged! One of the wildest things I’ve pulled off in my IT career.

        Maybe I should update and make a living offering my little class. Hmmm…

      • ChickenLadyLovesLife@lemmy.worldEnglish
        18·
        19 hours ago

        I worked for a tech giant that is a homonym of Sysco. The mandatory security training videos were I shit you not animated cartoon animals. I would be deeply concerned about security flaws in their products, except that I never encountered anyone there that had anything whatsoever to do with their actual products, nor did I encounter anyone who themselves had ever encountered anyone that had anything whatsoever to do with their actual products. This abstraction from the product line was actually a common topic of conversation there among the employees.

    • Dejected Warp Core@lemmy.world
      23·
      23 hours ago

      Some companies are just as ethically bankrupt all the way down to the mailroom.

      Once, I worked at a place that had, and I kid you not: “Ethics awareness training.”

      Said presentation had a few slides dedicated to mandatory legal matters and that was it. Ethics? Training? Awareness? Nevermind all that, did you know that we’ve always had Eurasia as a loyal customer? I didn’t stick around for very long.

      • jaybone@lemmy.zipEnglish
        37·
        22 hours ago

        The training is not for you. The training is to protect the company.

        If anything ever happens that results in some kind of legal action, the company can say they gave the employee the training and the employee successfully completed the training, therefore we did all we could to prevent this and we are not liable. So then it all falls on you.

      • ElChinchilla@lemmy.world
        13·
        22 hours ago

        I took a very similar presentation from the shadiest company I was ever employed by, specifically that “gifts and other favors” are generally guidelines to be followed by local customs. I.e. bribe away as long as you aren’t in the United States. Weird as fuck for a company that solely does commerce in the United States to have murky guidance on this very clear issue.

        My role here was very brief, they hired me for a licensed role and then paid me as a customer service rep, so I quit immediately after my first paycheck was about $3,000 short.

  • Rentlar@lemmy.ca
    96·
    24 hours ago

    Why is my company’s cybersecurity training limited to simulated phishing emails and online courses?

    Maybe next year’s cybersecurity budget should include some for hot-looking models (of every gender).

    • TubularTittyFrog@lemmy.worldEnglish
      18·
      24 hours ago

      c-suite doesn’t take those trainings. typically they will get all sorts of exceptions from IT too, because they are in charge.

      Only the peon workers get secured/locked down IT stuff.

      also hot babes are not going to bonk you for your company secrets unless you’re in executive management.

      • Wildmimic@anarchist.nexusEnglish
        10·
        22 hours ago

        also hot babes are not going to bonk you for your company secrets unless you’re in executive management.

        or at least have access to some spicy shit in your job.

      • jaybone@lemmy.zipEnglish
        31·
        22 hours ago

        I have to wonder though, do those types even know how to get access to source code or data? Seems like the grunts would have better access to that. Or maybe they are googling “what is git clone”, “how to run sql query”?

        • TubularTittyFrog@lemmy.worldEnglish
          7·
          21 hours ago

          Doesn’t matter if they know how to, what matters is they have access. The person that uses their access to steal stuff certainly will know how to do it.

  • Lushed_Lungfish@lemmy.caEnglish
    10·
    20 hours ago

    Fortunately, I am far too ugly and too poor to be a security risk.

    EDIT: I am secure on my ugliness and poverty.

    • Mycatiskai@lemmy.ca
      9·
      21 hours ago

      You can be ugly and poor and a security risk. If you are insecure enough and lonely enough to fall for the honey pot then out goes the security.

      If you are secure enough in your ugliness and too busy eeking out an existence then a honey pot won’t work because you know their interest is your body of work not your actual body.

  • myyass@lemmy.world
    2·
    16 hours ago

    I’m giving up on c-sec. I don’t want to play with swiss cheese for the rest of my life unless it’s on a raklet.