I am taking a required online training on "internet security" at my new university.

[sebzuen@toot.community]

@actualham Same vibe at my Uni where they hosted a „digital privacy day“, meanwhile the whole infrastructure got moved to microsofts cloud apps

[paco@infosec.exchange]

@actualham I assume you probably got a link to that training by email. And it went to some site like mycompanytraining dot com, when your company’s domain is mycompany dot com. So you just clicked the link in the email to launch the web training that has you turning off the ad blockers and pop up blockers…

Perfect

[mrgrumpymonkey@mastodon.social]

@actualham Time to run this in a VM.

[ilka4you@mastodon.social]

@actualham either this is a scam or this training is not worth its fee.

[retreival9096@hachyderm.io]

@actualham from the "People not clear on the concept" department.

A similar experience I had was trying to convince Corporate IT that they needed to get all company web sites to have valid certificates signed by a trusted authority. We were essentially teaching people every day to ignore the warnings the browser would pop up. Especially since valid sites they wanted us to go to had names like
my-company.hr-for-you.com, so it would be easy to fake a web site to send people to.

[w_b@mastodon.world]

@rgulick @actualham

Those that can't teach teach teachers

[tregeagle@mastodon.sdf.org]

@actualham @rgulick management getting in the way of education. It's the late-capitalism way. I've learnt that any mandatory education with the word Cyber in the title has little to do with security.

[crisps@mastodon.social]

@moz @actualham @adamrice FLASH YOU, MOTHAFLASHA!!

[lackattack@mastodon.social]

@crisps @moz @actualham @adamrice what the flash?? every time I type flash it changes it to flash

[billysmith@social.coop]

@ZS @actualham

Even worse, the SCORM standard was developed for the USA DoD

Wikimedia Error

(en.wikipedia.org)

[oskard@mastodon.nu]

@actualham every ”security training “ is like “do exactly what you should never do”

Where I work the the url in the emails seem to have numeric values for that particular phishing email as well as the targeted user.

I’m tempted to write some code that loops through all possible values and do a http GET.

[andreasdavour@dice.camp]

@actualham sadly I recognize the experience.

[ton@social.coop]

@actualham
I flat out refused to do the knowb4 training my current uni started last year and demonstrated to them why it was a security problem.

Then I started getting laughably obvious phishing from knowb4. Sent the office a pdf of the message source for the last one and I think they gave up.

(Background, our uni email delivers endless spoofed and phishing, has a 1998 webmail interface, no IMAP, no forwarding, no out of office messaging, does not comply with basic standards, and was hacked into a major spam factory a few years ago. No changes. Just blame it on the users.)

[pthane@toot.wales]

@actualham Maybe that was part of the training,? If you comply, you fail the course.

[nmba@mstdn.ca]

@actualham
Faculty associations really need to stand up now. Well they needed to stand up when terrorist trump was gleefully attacking education, but better late than never.