I am taking a required online training on "internet security" at my new university.

[paul_ipv6@infosec.exchange]

@actualham

i was working for a large corporation during a time they were going through the due diligence for a merger. since both companies were publicly traded, there were some very strict SEC rules about access to the info from both companies.

in order for me to see said documents to do the techical review, it required that i used only windows explorer, disable all ad blockers, all security features, and authenticate over an insecure web link.

yay for security...

[cadbury_moose@wandering.shop]

@paul_ipv6 @actualham

I hope you demanded an expendable computer and printer for the purpose and had them securely destroyed afterwards.

...and then washed your hands thoroughly.

3:O)>

[pseudonym@mastodon.online]

@paul_ipv6 @actualham

Same as it ever was. Same as it ever was.

As part of #infosec, I weep when I see stuff like this and the training class.

The unauthenticated emails from 3rd party platforms that HR uses to inform employees of legit business stuff, the surveys, all of it.

And they wonder why BEC (business email compromise) keeps happening when the bad guys send a legit looking "We changed our bank account, please update this routing number" email to Accounts Payable.

[stevegis_ssg@mas.to]

@actualham

I used to have to do a sample submission procedure that required both enabling Excel macros and enabling JavaScript and I thought, I don't *really* believe that whoever set this up is a mole for a botnet farm, but I can't see how their behavior would be any different if they were.

[cadbury_moose@wandering.shop]

@rgulick @actualham

And the final part:

Those who cannot teach administrate[1].

[1] or alternately: "teach teachers".

[softproof@mastodon.social]

@actualham They prolly also strongly advised to use google chrome because, well, the internet loves it. Good times for good people.

[jake4480@c.im]

@actualham 🤮

[forteller@tutoteket.no]

@actualham After doing all that one should just come to a website saying "you failed the class"

[paul_ipv6@infosec.exchange]

@pseudonym @actualham

i worked at a company that did 3rd party phishing mandatory training, with "click on this link" to start the video.

HR forgot to tell anyone that the email would be coming from a 3rd party or what domain name it should be for the link.

our VP of engineering was pretty proud that over 70% of the engineering part of the company reporting the email as a suspicious phishing attempt. sadly, we still had to watch the video, which was pretty useless...

[actualham@social.coop]

@rgulick note that my excellent uni has world-renowned experts on cybersecurity, and highly skilled instructional designers. But all of this was farmed out to a third party, which is why it could hardly run inside our canvas without everything breaking. Another example of how we hire consultants to sell us what we could do better ourselves but think we can’t “afford” to support internally.

[zs@techhub.social]

@actualham As someone who develops and supports e-learning, I can tell you that ALL the software available to produce and then host it is terrible. In ours, depending on which software was used to create the SCORM you either must use Edge for some and Chrome for others. It’s a total nightmare.

[actualham@social.coop]

@ZS SCORM was a new term for me and it was at the root of the whole fiasco I have learned

[actualham@social.coop]

@softproof yes. I always use a lot of hand sanitizer after I have to whip out Chrome 🤮

[zs@techhub.social]

@actualham The struggle is real. 2 years in the e-learning team broke me, just waiting a transfer to a different department to get away from it.

[beachbum@mastodon.sdf.org]

@actualham Hmmm. Sounds counterproductive to me and kind of risky.

[cstamp@mastodon.social]

@actualham That seems a work computer thing.

[rogerbw@discordian.social]

@actualham And when you say "no", I bet they don't give you a pass…

[manchicken@defcon.social]

@actualham how else are they going to train you to know how you’ve been breached if you haven’t been breached? Windows and macOS both have a bunch of new features to breach, so it’s important to know what it looks like when they are breached.

[wideeyedcurious@mstdn.social]

@actualham 🫤

[rasterweb@mastodon.social]

@actualham Admiral Akbar.gif alt text "It's a Trap!"