I am taking a required online training on "internet security" at my new university.

[ohir@social.vivaldi.net]

@actualham @rgulick
> all of this was farmed out to a third party
Internal team would not pay the comission to the pockets due, simple as that.

[wtrmt@mastodon.social]

@actualham malicious actors are the reason we can’t have nice things:

It seems that there’s no way to share anything with a URL these days.

You can’t even trust QR’s, and that is the only way to read a restaurant’s menu in Santiago since the pandemic.

[leonardof@bertha.social]

@actualham

[tknarr@mstdn.social]

@actualham At least where I work I can legitimately respond "Can't do. Those settings are managed by security policy and the ability for users to change them is disabled.".

[moz@fosstodon.org]

@actualham @adamrice "oh flash" sounds like an adult not swearing around the kids.

[benroyce@mastodon.social]

@actualham

i invite people to look at this account and the creation date and the message history

and then remark on the hilarious irony of such a message existing in this thread

EDIT:

this comment is not a reply to actualham, it is a reply to an intervening comment i did not mention so they would not see my reply in their notifications. it seemed like a scam, and it is now gone

[sebzuen@toot.community]

@actualham Same vibe at my Uni where they hosted a „digital privacy day“, meanwhile the whole infrastructure got moved to microsofts cloud apps

[paco@infosec.exchange]

@actualham I assume you probably got a link to that training by email. And it went to some site like mycompanytraining dot com, when your company’s domain is mycompany dot com. So you just clicked the link in the email to launch the web training that has you turning off the ad blockers and pop up blockers…

Perfect

[mrgrumpymonkey@mastodon.social]

@actualham Time to run this in a VM.

[ilka4you@mastodon.social]

@actualham either this is a scam or this training is not worth its fee.

[retreival9096@hachyderm.io]

@actualham from the "People not clear on the concept" department.

A similar experience I had was trying to convince Corporate IT that they needed to get all company web sites to have valid certificates signed by a trusted authority. We were essentially teaching people every day to ignore the warnings the browser would pop up. Especially since valid sites they wanted us to go to had names like
my-company.hr-for-you.com, so it would be easy to fake a web site to send people to.

[w_b@mastodon.world]

@rgulick @actualham

Those that can't teach teach teachers

[tregeagle@mastodon.sdf.org]

@actualham @rgulick management getting in the way of education. It's the late-capitalism way. I've learnt that any mandatory education with the word Cyber in the title has little to do with security.

[crisps@mastodon.social]

@moz @actualham @adamrice FLASH YOU, MOTHAFLASHA!!

[lackattack@mastodon.social]

@crisps @moz @actualham @adamrice what the flash?? every time I type flash it changes it to flash

[billysmith@social.coop]

@ZS @actualham

Even worse, the SCORM standard was developed for the USA DoD

Wikimedia Error

(en.wikipedia.org)

[oskard@mastodon.nu]

@actualham every ”security training “ is like “do exactly what you should never do”

Where I work the the url in the emails seem to have numeric values for that particular phishing email as well as the targeted user.

I’m tempted to write some code that loops through all possible values and do a http GET.

[andreasdavour@dice.camp]

@actualham sadly I recognize the experience.

[ton@social.coop]

@actualham
I flat out refused to do the knowb4 training my current uni started last year and demonstrated to them why it was a security problem.

Then I started getting laughably obvious phishing from knowb4. Sent the office a pdf of the message source for the last one and I think they gave up.

(Background, our uni email delivers endless spoofed and phishing, has a 1998 webmail interface, no IMAP, no forwarding, no out of office messaging, does not comply with basic standards, and was hacked into a major spam factory a few years ago. No changes. Just blame it on the users.)

[pthane@toot.wales]

@actualham Maybe that was part of the training,? If you comply, you fail the course.