Red Phish, Blue Phish: A New Approach to Phishing Simulations
summary
Describes applying a phishing risk model that quantifies risk by assets, defenses and user susceptibility to make simulations mimic attacker behavior. Covers why common company phishing programs fail, how risk-based models can improve effectiveness, and how to implement this modeling and testing in your own organization.
AI-written summary · about
chapters (34)
- 0:00Intro
- 3:42Awareness Education Program
- 4:51Fishing Risk Model
- 5:25Measuring sophistication
- 10:51Examples
- 12:44Landing Pages
- 13:09Orange Fish
- 14:43Targeted Attacks
- 16:06Manager Performance Review Training
- 17:43Setting Up Your Environment
- 18:06Where Do They Come From
- 18:26Four Simple Questions
- 19:29Example Architecture
- 20:15Measuring Metrics
- 21:38Understanding Your adversaries
- 21:50How Many People Get This
- 22:04Spam Filters
- 24:48Google Safe Browsing
- 25:25How do you subvert phishing filters
- 26:49Haphazard phishing
- 28:10Not measuring
- 28:59Creating a repeatable process
- 29:51The onefish mentality
- 31:14Magic fishing
- 32:38Machine
- 32:51Wrist Model
- 33:51Assets Model
- 34:25Financial Data Model
- 35:15Phishing Risk Model
- 36:12Example
- 38:50Value of Phishing
- 40:37Results
- 41:51Takeaways
- 43:42QA
related talks
27mBlunting the Phisher's Spear: A Risk-Based Approach...
06mSoK: Still Plenty of Phish in the Sea — A Taxonomy of User-Oriented Phishing
51mDeepPhish: Simulating Malicious AI
38mClick Here Now: A Positive Way to Create Phishing Awareness
41mRed Phish, Blue Phish: Improved Phishing Detection Using Perceptual Hashing
41mHook, Line, & Sinker - Addressing the Human Risk of Phishing and How to Avoid the Bait
52mWho Says Cybersecurity Can’t Be Creative?
42mPhishing With a Net: The NIST Phish Scale and Cybersecurity Awareness