A company I was in a few jobs back had several layers of IT department, there was the local studio department that handled our everyday stuff and a “head office” somewhere far away that set policy and handed out budget and whatnot.
One day “head office” IT decided it was a good idea to send out some fake phishing emails to “test” us. They didn’t tell the local IT department about it, I guess they were also being “tested”. My manager received one and only recognized it as a phishing attempt after he’d clicked just one too many things for it to feel safe to ignore. So he yanked the power on his computer and contacted the local IT department, as is protocol when something potentially dangerous just happened.
The local network went into lockdown while local IT tried to figure out if something actually dangerous had happened. It cost the studio as a whole several hours of work time, which for a studio our size translated to an obscene dollar cost. Nobody on our side of things did anything wrong, even that one extra “dangerous” click my manager did wasn’t something he could be blamed for - head office had crafted the fake phishing attempt well and his reaction to it would have prevented damage had it been real.
Phishing attempts that got far enough to actually show up in our internal corporate inboxes like that aren’t common, though. They’re normally blocked by the layers of firewalls and whatnot. We almost never saw email on those accounts from outside the organization itself, period.
And once you’ve run something capable of remote execution on a machine that’s inside the local network, with the sort of privileges that his machine had (he wasn’t just a bureaucratic sort of manager, he was writing code too), you don’t want to mess around.
A company I was in a few jobs back had several layers of IT department, there was the local studio department that handled our everyday stuff and a “head office” somewhere far away that set policy and handed out budget and whatnot.
One day “head office” IT decided it was a good idea to send out some fake phishing emails to “test” us. They didn’t tell the local IT department about it, I guess they were also being “tested”. My manager received one and only recognized it as a phishing attempt after he’d clicked just one too many things for it to feel safe to ignore. So he yanked the power on his computer and contacted the local IT department, as is protocol when something potentially dangerous just happened.
The local network went into lockdown while local IT tried to figure out if something actually dangerous had happened. It cost the studio as a whole several hours of work time, which for a studio our size translated to an obscene dollar cost. Nobody on our side of things did anything wrong, even that one extra “dangerous” click my manager did wasn’t something he could be blamed for - head office had crafted the fake phishing attempt well and his reaction to it would have prevented damage had it been real.
Head office never tried a stunt like that again.
Given how common phishing attempts can be though, shutting down for every single one seems like overkill.
Phishing attempts that got far enough to actually show up in our internal corporate inboxes like that aren’t common, though. They’re normally blocked by the layers of firewalls and whatnot. We almost never saw email on those accounts from outside the organization itself, period.
And once you’ve run something capable of remote execution on a machine that’s inside the local network, with the sort of privileges that his machine had (he wasn’t just a bureaucratic sort of manager, he was writing code too), you don’t want to mess around.
All I could think as I read this was Dwight’s fire drill from the office