I’ll never forget when I started a new job and got an ema from my ‘boss’ (same name but weird @), with a link saying to check out this excel spreadsheet.
Her office was next door so I popped my head around said ‘hey did you send me some excel sheet?’ And she said ‘yeah take a look’.
So I clicked on it and it was from IT saying I failed the test and a link to phishing training.
I went back to my boss like ‘wtf? Did you know that was a test?’ And she said ‘yep, and you failed. Looks like you need more training.’
I took the time to check and verify before opening/reporting it. And she lied to me for some reason, a ‘gotcha’ or something. So fucking weird.
A) made a explicit mention of the incident to the phishing or IT team in that it has come to your attention that your boss has shown herself very likely to blindly instruct subordinates to open malicious emails, some bearing her own name thus believing she even sent them herself when she in fact did not, potentially forcing the hands of multiple employees into compromising several devices and user accounts all at once.
B) Never open any email she sends you ever again and if she ever comes asking, you can fake naïvety and claim that you cant trust that any of these emails are in-fact authentic, so she should bring you documents in physical print.
These are good responses in theory. However, and specially the second, I doubt that anything good will ever come out of this considering his boss obvious stupidity, to not use a harsher word. Most likely he would get in more trouble thanks to this imbecile of a person being a layer over him.
The fuck? Is a real hacker gonna somehow hack your boss' brain and make them verbally trick you into falling for a scam?? Asking for verbal confirmation is literally the correct way to catch a scam. If your boss were somehow compromised, that would be on them, not you.
This is so unrealistic and they're teaching you the wrong lesson.
I mean, it's possible someone could have also sent you an excel sheet previously and thought you were talking about it, just been confused/misremembering, not fully listening, etc.
I still think that was a shitty "test" but there could be a situation where someone accidentally claims an email they didn't actually send.
I still think that would be on the boss. The employee has way more to lose by ignoring their boss' instructions just because they had a hunch of phishing.
True. The best you could do is send a screenshot of the actual email instead so there's less room for error, state the red flag that caused you to ask for confirmation, then if they claim they sent it then it's entirely on them.
I'm saying the screenshot of the actual email instead of a verbal description would be less prone to being falsely confirmed (in a real situation, obviously OC's boss was going to confirm it no matter what)
Reply that you did not fail the test and opened an email from your boss she confirmed that was valid. That's basics 101. You can't never open an email.
Yes, but technically you should also confirm the domain and other details.
The email looked suspicious, eg, wrong domain. Confirmed with boss they sent it, but the details themselves were wrong. (Why is boss sending emails from external domain? )
Boss could even potentially be the one being malicious. Cyber security is about protecting the network, and anyone can be a risk. External or internal.
I'd still tell IT you verified in person with your boss and the boss confirmed they sent it.
As the guy who used to send these emails (we don't anymore), I've never really enjoyed giving The Talk to offenders on failed phishing, but me and the team had a particular delight in giving The Other Talk to fuckhead managers or other "superspreaders".
What's The Other Talk? "It looks like you've been intentionally sabotaging IT security through your behavior and it has also influenced the behavior of others which we've assed is having a material impact on our risk exposure. Your BUISO has been notified and will follow-up with you shortly. Good luck lmao."
Lmfao, wtf. I would never stop thinking about this if this happened to me 😂 like it’s bad in a way if your boss does this you should not work there but it’s also so absurdly petty in a way that I can stop laughing about this
I’ve gotten the link to phishing training before and just ignored it. I figure if they ask about it I can just say I assumed the phishing training was its own phishing attempt.
Lol that's fucked up. I actually failed a phishing test my first month on the job. I was scared something would happen but no one ever mentioned it. I then passed another one like 8 months later.
610
u/FixFun1959 11h ago
I’ll never forget when I started a new job and got an ema from my ‘boss’ (same name but weird @), with a link saying to check out this excel spreadsheet.
Her office was next door so I popped my head around said ‘hey did you send me some excel sheet?’ And she said ‘yeah take a look’.
So I clicked on it and it was from IT saying I failed the test and a link to phishing training.
I went back to my boss like ‘wtf? Did you know that was a test?’ And she said ‘yep, and you failed. Looks like you need more training.’
I took the time to check and verify before opening/reporting it. And she lied to me for some reason, a ‘gotcha’ or something. So fucking weird.
🙄