How AOPG Staff Fared in a Simulated Phishing Test

Phishing, above all by email, has turned into a serious problem. Criminals increasingly prefer a disguised message as their way into an organisation, and stopping them is harder than it sounds for two reasons. First, email-borne threats keep getting more sophisticated, and phishing messages are built specifically to slip past conventional email security tools. Second, phishing targets people, widely seen as the weakest point in any security chain. However strong the defences, an attacker who can fool someone inside the perimeter can then do more or less as they like.

Teaching users about the risks and how to spot a lure is one answer. Phishing simulation is another, and a growing number of businesses use it to raise security awareness among staff. In a simulation, a company sends its own employees deceptive emails modelled on what real attackers write, then watches how people respond. Experiencing a phishing attempt first-hand is arguably the best way to understand one. Run regularly, the tests also give a structured way to check compliance and track improvement over time, much like a fire drill adapted for the digital age.

Three lures, one per team

In September 2019 the management of AOPG, the publisher of this site at the time, put its own employees through such a test. It used PhishLine, Barracuda's platform for social engineering simulation and training, and ran the exercise without telling staff.

The emails differed by team, each chosen for the best chance of a click. Editorial staff were told they had been nominated for a press award. The requirement investigation and marketing unit received "cold calling tips". HR was sent a convincing parcel notification that appeared to come from Poslaju. In every case the aim was to make the recipient believe the email was genuine and click a link inside it.

Tailored phishing of this kind is called spear phishing. PhishLine had an insider to help, a member of AOPG's management who knew the company and its people well enough to supply details that would make the campaign convincing. In a real attack, that insider might be someone working for or with the organisation, someone with physical access to its premises, or a former employee. Even without inside help, an attacker could collect plenty of material simply by searching the internet, given how visible companies and their staff are online and on social media.

The outcome: of the 19 emails sent to AOPG staff, seven led to a click on the planted link.

Why a single click is enough

Asked about it afterwards, most of those who clicked said they either had no suspicion the email was fake, or had some doubts and clicked regardless. A few never saw the email and did not know a test had happened.

The award nomination and the Poslaju parcel notice drew more clicks than the cold calling tips. That fits with how hard attackers work to find the right hook: the better the bait suits the target, the likelier the attack is to succeed.

A click rate of a little over 35%, roughly one employee in three, is a real risk. One mistaken click by one person can be enough to cause fraud, a data breach or heavy financial and reputational damage to the whole organisation.

James Forbes-May, Barracuda's Vice President of Sales for APAC, said that clicking a phishing link puts the user in the criminal's territory. The click itself shows the attacker has won some degree of trust, so the victim is more likely to type a password into a fake page. Depending on how advanced the attacker's tools are, he explained, even lingering on the page can be risky: the attacker may monitor behaviour there to learn the person's interests and habits for later targeting, or look for ways to download malicious files onto the device being used.

In most targeted attacks, he added, a click on an unknown link tends to lead to one or more of the following:

1. The attacker gets a chance to learn about the victim's environment.
2. It can open the way to targeted attacks that exploit weaknesses in that environment to spread malware or exploits, usually through drive-by downloads.
3. It can lead to credential harvesting, one of the ways attackers gain access to infrastructure and systems.

For years, phishing emails have tricked people into handing over login details or financial information, and sometimes into transferring large sums of money. Phishing usually needs a person to act, by clicking a link, installing software or opening an attachment, which is why a simulation aimed at people matters.

Training at the moment of the mistake

An employee who clicks a link in a simulated phishing email is not exposed to anything harmful. They land on a short training page explaining what just happened, what phishing is and why it is dangerous. PhishLine says this immediate, bite-sized training works very well.

Aron Raj, one of the AOPG staff who clicked, agreed. His first reaction was alarm that he had followed a malicious link. Reading the personalised educational content, he calmed down and understood it had been a training exercise. He said the approach had an immediate effect and had made him more alert to what arrives in his inbox.

Most AOPG employees had heard of online scams, but not all of them knew the term phishing. The plain advice on the training page, along with a short video on phishing, helped them understand how this deceptive threat works.

The problem of staff warning each other

One criticism of sending a simulation to every employee at the same moment is that it can produce social desirability bias. Unless staff are told in advance not to, which would spoil a surprise drill, the first people to spot the email often warn their colleagues. Once people know a test is running, the results say much less.

That did not happen across AOPG as a whole, although an earlier "victim" did alert a couple of employees to the emails. On the whole, the simulation left staff more aware of what might be hiding in their daily email and kept them on guard. All of them said they would be more careful from now on about opening unfamiliar emails and clicking unknown links.