For years, we have known about phishing as an effective vector into corporate networks. Malicious actors use phishing to obtain credentials and other sensitive data, install malware and a lot more. Recently, the SMiShing vector has taken center stage mainly due to the Twilio breach. This breach has undoubtedly caused CSOs and other information security staff sleepless nights. While phishing testing and training may have become mainstream, SMiShing testing is lacking. In part, it is lacking for legal reasons.
Image: Incident Report: Employee and Customer Account Compromise – August 4, 2022 (twilio.com)
It is relatively easy for a company to dedicate resources to new phishing or vishing testing. One call to Social-Engineer, and this testing can happen in no time. However, if a company wants to begin SMiShing testing, there may be an immediate roadblock. The difference is the assets that are used in testing. When performing phishing training, tests are done by sending phishing messages to the employee’s company email account. The company owns the account and servers. The situation is similar for vishing testing. The company owns the phone number that is called. As the owner of the email account, server and phone number, the company can consent to the testing, and the employee does not need to be made aware.
Update Your BYOD Policy
If a company wants to begin SMiShing testing, the testing might not be so straightforward. Few companies provide mobile devices to their employees. Employees often bring their own devices (BYOD) to use at work. The problem is that the owner of the device, the employee, has usually not consented to it being used for testing. Also, if the reporting process is not known to employees or does not exist yet in your company that could make the testing less valuable.
Our recommendations on how to handle this are for companies to update their BYOD policy immediately and establish a reporting process for employees to submit suspected SMiSh for review by their security team. The policy must have the employees’ consent to security testing and training on their devices, especially when they are using their own devices to log in to corporate resources. Once this policy is updated, a reporting process should be established that makes it easy for employees to capture the needed details and alert security staff to a possible active attack.
Once you are ready to begin SMiShing testing, you can partner with Social-Engineer as part of the Managed SMiShing Service. With this service, employees will learn what a SMiShing message looks like and how to report it safely. At Social-Engineer, our difference is that we focus less on click rates and more on reporting rates. Reporting is crucial to protecting the company’s sensitive information and employees.
So, update the BYOD policy and set up a reporting process. Let your employees know of the changes and get started with SMiShing testing today!
Written by: Patrick Laverty
For a detailed list of our services and how we can help you achieve your cybersecurity goals please visit:
https://www.social-engineer.com/offensive-security/.
