DNC Phishing Scare Was a Training Exercise Gone Awry: Lessons Learned

It seemed like déjà vu’ all over again. Echoing one of the most talked about successful phishing attacks of all time, the Democratic National Committee (DNC) once again had cause to raise concern recently believing that it was the intended target of a new phishing campaign. And, given upcoming elections in the US, the DNC had every reason to take the threat of attack seriously. The then-known evidence and facts seemed to point to a motivated attacker was building a sophisticated phishing campaign, including a credential harvesting webpage “target[ing] the Democratic Party’s voter file, known as Votebuilder.” Even the FBI, the DNC’s CISO, and outside security companies believed the trail pointed to a malicious attack…. Except it wasn’t malicious. And it wasn’t an attack… at least not in the traditional sense.

As experts and the media had more time to study the evidence, it became clear that all of the fear and excitement was over simulated phishing test conducted by the Michigan Democratic Party. Oops…

What Went Wrong?

As you can imagine, the answer is: “A few things.” First and foremost, there was a lack of communication. The simulated phishing test was conducted by a third-party contractor that was hired by the Michigan Democratic Committee – which is not authorized to conduct the testing; and is technically a separate group from the DNC. The New York Times stated, “The blunder was caused by a lack of communication between the national committee and one of its state branches, the officials said. The Michigan Democratic Party had hired hackers to simulate an attack known as phishing, but did not inform the national committee.”

And, not only did they not communicate appropriately about the testing, the way the group went about setting-up the scenario had all the hallmarks of a real phishing attempt, and none of the signs (or benefits) of a training campaign. The Times again reported that they registered new domains specifically for the event, and the landing page “very closely mimicked the infrastructure you’d see actual hackers using,” said Bob Lord, CISO for the DNC, “At the time that it was detected by outside parties, it did not exhibit any of the characteristics of a training system.”

The sad truth is that all of the drama could have been avoided if they had only followed a few well-known best practices. Instead, it seems that they took a more maverick approach and ended-up with an embarrassing outcome. Unfortunately, while this is much bigger from a media perspective than many of the stories I’ve heard before, the embarrassing situations are generally the foreseeable result for people who try to conduct simulated phishing tests in a caviler way.

Avoid Embarrassment by Knowing Goals & Scope

Here’s how you and your organization can avoid this type of embarrassment: it’s all about understanding your goal and scope. If your goal is just to see where problems might be (without education), then you are essentially doing a penetration test (we’ll leave that goal aside for now). But, if you are wanting to shape behavior, then education is key. And with education comes the need for clear communication, processes, and systems.

After you’ve clarified your goals, it is critically important to engage your stakeholders. This includes validating your goals, methods, processes, and ground rules. It’s very clear that, in the recent DNC snafu, stakeholders were NOT engaged or informed. That single missing element was what led to all of the other confusion and the associated waste of time, energy, and resources.

Best Practices Matter

As the security vendor providing the world’s most popular platform for conducting simulated phishing and social-engineering testing, we know that maverick missteps like the ones leading to the confusion last week can taint the entire idea of conducting simulated phishing exercises. Fortunately, though, embarrassing issues like that can easily be sidestepped by adhering to best practice advice. Doing so results in a win-win for all involved; embarrassment is banished, employee behavior related to phishing is improved, and the organization becomes more resilient.

So, what’s the upside of this situation for the DNC? At least they got to test their incident response plan and know that the security community is on the lookout for bad actors and bad actions. You know how sometimes members of your local neighborhood watch group are suspicious of your brother-in-law’s sketchy van parked near your house? You’ll be thankful for them when they notice real threats. But, in the meantime, it’s best to curtail all of the drama through clear communication and processes.

About the author:Perry Carpenter is the Chief Evangelist and Strategy Officer for KnowBe4, the provider of the world’s most popular integrated new school security awareness training and simulated phishing platform.

Copyright 2010 Respective Author at Infosec Island via Infosec Island Latest Articles "https://ift.tt/2NhocdJ"