Week 9 CYBR 650 Blog

Are We More Vulnerable Mid-week?

While conducting research this week I stumbled across an interesting statistic in the eSentire 2nd Quarter Threat Report. This is an excellent threat source. Towards the end of this product, they were reviewing statistics associated with phishing. They claim that Tuesdays, Wednesdays, and Thursdays are days that employees are more likely to click on a phishing link. Additionally, Wednesday and Thursday account for nearly 50% of credential submitting occurrences. I had honestly never thought of this before. Generally being interested in social engineering, I wondered why this is true.

eSentire Q2 Threat Report

Explanations for this

Wombat Security's 2018 State of the Phish also highlighted a similar notion. So is this a human thing to be more careless in the middle of the workweek. I could not find anything to support that claim. Monday's are the most common day for a workplace mishap. It is probably more related to the workflow of the typical week. Monday's might see more focus on important tasks, rather than the sometimes trivial nature of phishing, which attempt to catch people on autopilot. The article points out that Friday email management may consist of emails pertaining to specific weekly deliverables. This leaves mid-week for more routine or mundane management of mail, prime territory for phishing to operate.

This can also be attributed to overall workforce flow. Over the course of a year I definitely have more Mondays and Fridays off than any other day. Unfortunately, there doesn't seem to be any concrete evidence out there supporting this claim. Whether there are actual reasons for this data, or this was an aberration, this information can still be wielded tactically. For instance, if you have security awareness materials to present, maybe don't deliver them on a Monday or a Friday. Monday's people are generally inundated with what they put off on Friday. Friday they are generally putting things off until Monday. Deliver your presentations or weekly cybersecurity e-mail mid-week. It may be a small advantage in user awareness, but in this business we take any advantage we can to heighten user awareness.

Comments

Post a Comment

Popular posts from this blog

Week 5 CYBR 650 Blog

Image
Will Harry and Mae’s Diner Ever Listen to their Paid Consultants? This week in class we are working through the familiar (at least for Bellevue Cybersecurity students) Harry and Mae’s case study . This examines a franchise of diners, and depending on the class you are in, you examine it through the lens required…it could be risk management, secu re network design, or threat analysis. One item I got to thinking about this week is the individual franchises under a company like this, and how much leeway they have when deciding how to run their own infrastructure. This is especially important when the headquarters policies dictate an insecure implementation of the IT equipment, such as is the case with Harry and Mae's. In my specific experience with them, this will be the third time I have recommended basic security configurations without any visible action on their part. Point of Sale Security Certainly, a hot-topic over the last few years, point of sale devices a...
Read more

Week 7 CYBR 650 Blog

Week 7 Blog Its National Cybersecurity Awareness Month! October is designated as Cybersecurity Awareness Month , generally a time of the year for the Government to post some helpful guidelines for everyday people to read about how cyber security could impact their lives. Typically, these involve a good exposure of common threats and vulnerabilities to personnel without much direct cybersecurity knowledge. This year there are four themes for the four weeks of the month: Cybersecurity at home, careers in cybersecurity, workplace cybersecurity, and critical infrastructure cybersecurity.   More specifically, week 4, Oct. 22–26 will be about safeguarding the Nation’s Critical Infrastructure. When most read this they correctly assume this means energy, financial, and emergency systems or maybe centralized communications and transportation. Those are all considered critical infrastructure, and afforded enhanced protection resources through that designation. One item that many ma...
Read more

Finally Here!

Hello all, welcome to my blog covering the final course in the Bellevue Cybersecurity Master's program. This has been quite a journey, starting back in the Winter of 2014. I am fully aware that four years is kind of excessive to complete 12 classes, but I went through at a pace that allowed me to enjoy life and accomplish other goals at the same time. My original goal was to complete my MS degree before retiring from the Air Force. Well, I hit that retirement button yesterday, requesting a retirement date of next year. So pending the results of this course (and the concurrent Risk Management course), mission accomplished! A bit about me. I am 37 years old and currently residing in Anchorage, AK. I married my high school sweetheart 18 years ago, and we have three wonderful children. We love Alaska, and all of the amazing things that you can only do here. I have about a year left to enjoy it, before we retire and transition to civilian life in Colorado, my hometown. I love fishing,...
Read more