12

On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are outlined in the link below:

Then again most of those same shops conflict with their own advice and require their use for certain situations such as:

Since inconsistent guidance never bodes well for security, I think that there should be a pattern, practice, or technology that will allow for better security and a consistent message.

Question:

  • What are our options in getting rid of this conflicting advice regarding links in email?

  • What patterns, practices or technologies should be adopted?

Community
  • 1
makerofthings7
  • 50,090
  • 54
  • 250
  • 536
  • 3
    Password reset links are expected, you will only click the link if you have demanded such an email before. That's a rule everybody should be able to understand. – martinstoeckli Mar 03 '13 at 20:04
  • I think practically speaking we shouldn't say "don't click on links", because the reality is that links are expected, users are going to click on them. Therefore the mission is teaching users methods that can be used to decide what links are probably okay and which ones should be avoided. – Awhitehatter Mar 05 '13 at 21:10

3 Answers3

4

You mention a very specific subset if phishing attacks related to fake password reset emails.

Assumption 1: you already have controls in place to reduce these inbound emails based on whitelists, SPF, whatever.

Assumption 2: you have controls in place to limit outbound website visits by your users to malicious sites.

Assumption 3: you are asking simply for a pattern (rule) to give to your users to help them decide when they should click a password reset link in an email vs being suspicious and not clicking... If not a pattern for users, then something more technical/automated.

Easy rule of thumb for users : Don't click password reset links in emails unless you are expecting to receive such an email.

If you receive an unsolicited password reset email, ignore/report it to IT. If you request a password reset from SaaS application XYZ and you receive an email from application XYZ in the next few minutes, it is probably legit.

Brian Adkins
  • 1,817
  • 1
  • 17
  • 14
  • 2
    Easy for IT guys probably; but your organization have mix of people for different jobs and responsibilities. The gap between your knowledge of the attack and their ignorance is where the risk lies and this is where security awareness program comes in. – Saladin Mar 03 '13 at 16:52
  • I agree that awareness is the key. I have small company which makes it easier. I also send out phishing IQ tests to increase awareness. http://www.sonicwall.com/furl/phishing/ http://www.opendns.com/phishing-quiz/ – Brian Adkins Mar 03 '13 at 16:59
  • IQ test works good from management to release their responsibility in case of liability. But in reality you have to prepare your employees for their response in real-world; this means conducting live exercise. But i also agree small companies can have budget issues too. So its a gamble security is just like everything else in the world. – Saladin Mar 03 '13 at 17:02
  • Always a gamble... But I do believe that phishing examples (tests) have more value than simple responsibility theater on management's part. – Brian Adkins Mar 03 '13 at 17:10
  • What works for one company doesn't necessarily works for the others. Whats interesting is the stats people getting infected through these attacks follow up with example tests versus # of people infected followed with live mockup tests. Any program is judged by its outcome this cases means reduction in # of attacks. I also think the management should invest in compensating technologies (antiphising controls) to reduce to fall-out risks. – Saladin Mar 03 '13 at 17:13
2

The root issue on this matter is how can you help users better distinguish a legitimate email versus an illegitimate email. There is also a secondary issue of how to get the user to perform an action securely when they are told not to trust the link in an email.

For the first problem, here are some technical controls which could be implemented:

  1. Use encrypted/signed emails. Let's pretend that in the future we can easily setup users to obtain and use private/public keys. Then you can tell users to only trust actions if the email has been signed and they have verified the message using the trusted public/private key pair. There is a threat, of course, of the private-keys being stolen, so for a public-facing company such keys may need to have relatively short expirations and a good mechanism for revocation.
  2. Put codes in the email which would be hard to phish. Many banking websites have implemented security pictures/security keys. The known flaw with those methods is if you take enough time you can get those security keys and still fake our the user, because these images are shown before the password is provided in the email. So, we modify the concept a little bit and we allow users to specify a phrase and image combination that is instead included in all of their emails, and is never shown before logon. In this way, you have a relatively reasonable assurance that the email came from the intended source because if they could have gotten that image it means they likely already hacked the server or hacked into your email, and they can just reset your password through email while you are sleeping.
  3. A little less involved than the above, I receive some bank/credit card emails which include a truncated portion of an account number. This would be difficult to fake without already compromising the user or the computer, but most people probably don't recall their account numbers. If it was part of a credit card PAN, that would probably be much more likely for an attacker to find by hacking other websites.
  4. Have an active program to identify phishers through working with email providers, law enforcement, and end users. The more they report back to you phishing attempts, you can at least try to identify servers, email addresses, misspellings, patterns, etc. Hard to be ahead, but catch up.
  5. On the customer side or email provider side, they should implement controls like spam filters, heuristic phishing warnings, some type of whitelist for known email accounts that have the ability to send the reset link or other crucial information.

On the non-technical side, its mostly all about training and awareness, but also about making it easy for the end user to verify suspicion. To do this, you can provide links on your webpage showing how to spam phishing and how to check the authenticity, hopefully a few users will learn. Send out awareness in newsletters, other information in emails and in mailings. If you have an internal helpdesk or a customer support center, make it easy and convenient for users to contact the helpdesk to ask about these issues. They should have someone they can ask about legitimacy of any such mailings.

More specifically, about email resets. Let's not provide them with a link. If you operate site.tld, then you can have them enter a form at site.tld/reset. Ask for the email and the one-time token on the web page and make them visit it manually and type in the code manually.

If your testing or knowledge of the users indicate they are incapable of cutting and pasting, then you need to do a risk assessment to determine the cost of securing versus ease/profit of not securing. How many customers will you lose from making the process less point and click, but more secure. What is the cost and damage to both you the company and to the customer if the account is taken over? Can you detect and reverse any malicious actions, transfers, deletions, posts, etc?

If we are talking about a pure internal environment, skip the reset emails altogether. Have a self service portal users must use, or better yet require reset in face or by phone, and if by phone, require some information to validate the identity. In a corporate environment, you can do this by asking for their employee number and their start month/date, or some other combination of information.

Email reset links should only be used for low priority and low risk. If you are doing something with personal details, finance, health info, etc. consider your pricing model and look at the cost of not using email. Eliminate the threat of the evil link, and let your users know: "We will never send you a password reset link by mail, we will provide you a temporary code via phone or SMS that will be good for 10 minutes, which you can use to reset the link by manually visiting the following link...If you receive any type of email about a password reset, please forward it to security@site.tld"

Lastly, the emphasis here has been on preventative controls, which are appropriate, but you can also implement detective controls to complement and in crease security. E.g., send the users an email anytime their password is changed or send them a SMS, etc. Maybe you can have heuristics looking at patterns, sources, and new password hashes coming in for password changes. If you see 10 different user's passwords being changed in 5 minutes, from the same ip, and the password hash comes out the same (would need to think about how to temporarily store the hash securely without salt), then you can stop investigate and freeze the affected users' accounts.

Eric G
  • 9,691
  • 4
  • 31
  • 58
  • Interesting answer, love the technical controls, now here this I as Security top-notch in the company see these technical answers just as more technical things users should be aware of..( *More sec hassle*). In simple terms more money goes in building course contents, more money spent on trainers and also an exponential increase (in workers skill level expectation) I'm mean checking public/private keys is hard on this regard most end users don't even bother checking the email-headers or read the full url on the address screen. – Saladin Mar 03 '13 at 18:59
  • As for the image spoof thing, do you expect sites like ebay or facebook to add such security feature? Yours sounds more of a solution trying to protect its employees from phishing attacks generated using its own domain – Saladin Mar 03 '13 at 18:59
  • @asadz: Facebook and eBay should not have problems adding an image field in the user's profile, and then sending this in an email. It just another value they pull along with the user's actual name. The bandwidth cost to add this to emails is negligible. – Eric G Mar 03 '13 at 19:04
  • @asadz: In a corporate environment, you should actually have low-user cost to impelment signatures. You just deploy it, the email program can show evidence it was signed. You still need training though so they don't fall for "fake" security indicators in images built into the phishing email. – Eric G Mar 03 '13 at 19:06
  • I understand your point, but my point was when you bring new controls you also add new vectors too, configuration and change management is one but that for that tech guys to take in; but on training side it just means more thing (sometimes more complex thing) workers should be aware of. Such controls may be necessary for one company but not necessarily for another. Thus the risk analysis exercise is fundamental. – Saladin Mar 03 '13 at 19:09
  • As for facebook , e-bay i know technically it can be done but we don't expect others to introduce controls considering the risk appetite or threat profile of ones organization. – Saladin Mar 03 '13 at 19:12
  • @asadz: yes... as I wrote: "you need to do a risk assessment to determine the cost of securing versus ease/profit of not securing" – Eric G Mar 03 '13 at 19:12
0

I work in an organization which is is 25,000+ strong and there always is that constant need of providing adequate security awareness to the employees. Two things I always debate with management as they strategize the rolling out such a program.

Do research What is the data? corresponding data that links employees getting infected / frauded' with the use of such forged emails links. What current controls (e.g mail gateways devices) are doing to stop these attacks. What percentage is detected and what percentage is leaked?

Be practical

I have seen guides , presentation prepared and delivered by guys in black suits which looks dandy and just "sexy" for c-level executives. But , its just theory at the end and some cool snapshots what actually missing is the hands-on training, mock up exercise. Why use of tools such as owasp webgoat be restricted to security people? It should not be. A bunch of people at a seminar can look really bore looking at the colorful slides or find scratching their heads on a choosing which link to click or not to click. The entire means of scoring an employees awareness based upon MCQ test is flawed an unpractical if you are tasked with teaching a fish to swim backwards would you rather show slides or throw it in water and see how well they have trained. Sometimes teaching security (HR people) rhymes just like this analogy

FOLLOW BEST PRACTICE APPROACH AS A PROCESS

I don't many people are not familiar with SANS training methodology. There is an absolute effective and very reliable approach described by SANS regarding the effective roll-out of such programs in an organization. Their approach is broken just like CMMI (phased-wise) preparing the organization to mature and improve the process in each step of the way. The cool thing about this graphic is that management is sometimes so hungry for word change they totally forget the per-requsite required to implementing a perfect ideal change where every employees is not just security aware but vigilant to respond to incidents in effectively and timely manner. To get yourself close to this dream you require good research which is organization specific (see the threats vectors faced) and effective policy making comes in; when the policy makers through careful thinking with security teams have established that indeed phishing is on the top list of attacks the organization faces(e.g online merchant); and they are willing to write issue specific policy to address its concerns. When the risk is properly identified and stated in the policy; its just gets to compliance where HR teams can get involved in ensuring that their employees are regularly trained and updated about the recent attacks methodology.

enter image description here

Saladin
  • 1,547
  • 3
  • 14
  • 23
  • 4
    Interesting, but this doesn't answer the question... – Rory Alsop Mar 03 '13 at 18:47
  • Under the right context it is.Technology is not everything so is the answer. – Saladin Mar 03 '13 at 18:49
  • 1
    Right click? view image :) did you tried this. – Saladin Mar 03 '13 at 19:02
  • 1
    I agree with @Rory, I think this is a good answer, but for the wrong question. Have you considered posing the question which you are answering as a separate question, then answering it yourself? This is entirely acceptable on SE provided the question is a proper question (and you remember you might get some even better answers that you hadn't thought of). If it were me, this is what I would do with this answer. –  Mar 06 '13 at 16:42
  • I wonder if the question could be "how do I effectively communicate a security policy?" or something like that? We may already have one this answer would be suited for, actually. –  Mar 06 '13 at 16:45
  • I will do just that thanks friend:) and i would copy your question statement. – Saladin Mar 06 '13 at 17:02
  • Why the dupe? http://security.stackexchange.com/questions/32119/how-do-i-effectively-communicate-a-security-policy/32120#32120 – NULLZ Jun 24 '13 at 06:33