Methods and systems for implementing a phishing assessment

1. A system that tests for vulnerabilities in a computer network, the system comprising:

a phishing assessment computing server comprising one or more computer processors configured to test the computer network by:

initializing the phishing assessment, wherein the initializing includes:

collecting target entity data based on receiving an input of a target entity associated with the computer network; and

dynamically generating phishing attack constructs based on an input of the target entity data, wherein the phishing attack constructs comprise one or more fictitious attack domain names and one or more fictitious attack web pages, and wherein the one or more fictitious attack domain names are dynamically generated by modifying a target domain name;

configuring the phishing assessment, wherein the configuring includes:

setting an attack schedule for deploying one or more phishing attacks of the phishing assessment;

setting a testing duration of the phishing assessment;

determining a rating for each of the one or more fictitious attack domain names according to probable phishing attack effectiveness; and

setting a level of testing difficulty from a plurality of conditional levels of difficulty for the phishing assessment, wherein the level of testing difficulty is based on at least the ratings of fictitious attack domain names; and

testing for vulnerabilities in the computer network by deploying the configured phishing assessment using the dynamically generated phishing attack constructs according to [i] the attack schedule, [ii] the testing duration, and [iii] the level of difficulty.

2. The system of claim 1 , wherein

initializing the phishing assessment further includes:

identifying one or more target users of the computer network based on the input of the target entity data; and

identifying one or more communication vectors associated with the one or more target users of the computer network.

3. The system of claim 1 , wherein the initializing further includes:

using the collected target entity data to identify most frequently visited websites by the one or more target users of the computer network,

wherein generating the phishing attack constructs includes constructing a phishing attack website that mirrors a most frequently visited website of the identified most frequently visited websites.

4. The system of claim 3 , wherein

generating the phishing attack constructs includes removing or disabling an ability of the phishing attack website to collect user credentials or passwords.

5. A method that tests for vulnerabilities in a computer network, the method comprising:

at a phishing assessment computing server comprising one or more computer processors configured to test the computer network:

initializing the phishing assessment, wherein the initializing includes:

collecting target entity data based on receiving an input of a target entity associated with the computer network; and

dynamically generating phishing attack constructs based on an input of the target entity data, wherein the phishing attack constructs comprise one or more fictitious attack domain names and one or more fictitious attack web pages, and wherein the one or more fictitious attack domain names are dynamically generated by modifying a target domain name;

configuring the phishing assessment, wherein the configuring includes:

setting an attack schedule for deploying one or more phishing attacks of the phishing assessment;

setting a testing duration of the phishing assessment;

determining a rating for each of the one or more fictitious attack domain names according to probable phishing attack effectiveness; and

setting a level of testing difficulty from a plurality of conditional levels of difficulty for the phishing assessment, wherein the level of testing difficulty is based on at least the ratings of fictitious attack domain names; and

testing for vulnerabilities in the computer network by deploying the configured phishing assessment using the dynamically generated phishing attack constructs according to [i] the attack schedule, [ii] the testing duration, and [iii] the level of difficulty.

6. The method of claim 5 , wherein

testing for vulnerabilities in the computer network by deploying the configured phishing assessment is performed automatically and autonomously by the phishing assessment computer server without human intervention, and wherein

initializing the phishing assessment further includes determining whether an entity server associated with the target entity possesses one or more permissions for implementing the phishing campaign.

7. The method of claim 6 , further comprising:

authorizing an administrator for administering the phishing campaign, wherein authorizing the administrator includes:

collecting administrator data from one or more internal source of the target entity and/or from one or more web sources external to the target entity;

generating an authorization score for the administrator based on the collected administrator data, wherein the authorization score indicates an authorization level of a potential administrator of the phishing assessment, wherein the administrator comprises one of a network administrator or an administrative computer of the target entity.

8. The method of claim 7 , further comprising:

in response to generating the authorization score, setting the authorization level of the administrator, wherein setting the authorization level includes:

setting a first authorization level for the administrator if the authorization score satisfies an authorization threshold, and

setting a second authorization level for the administrator if the authorization score does not satisfy the authorization threshold but is above a minimum threshold.

9. The method of claim 5 , wherein

the testing duration of the phishing assessment is conditional;

setting the testing duration of the phishing assessment is based on a condition that the one or more target users successfully not succumbing to one or more phishing attacks implemented via the phishing campaign for a predetermined number of times.

10. The method of claim 5 , wherein

the testing duration of the phishing assessment is unconditional and predetermined;

setting the testing duration of the phishing assessment is based on testing a predetermined population over a predetermined period.

11. The method of claim 10 , wherein

setting the testing duration of an unconditional phishing assessment includes randomly selecting a subset of target users to test via the phishing assessment over predetermined sub-periods of the predetermined period until all target users of the target entity have been tested.

12. The method of claim 5 , further comprising:

identifying a plurality of communication vectors associated with the one or more target users of the computer network based on the target entity data; and

setting a phishing attack communication vector by selecting a communication vector from the plurality of communication vectors having a highest communication traffic.

13. The method of claim 5 , further comprising:

setting timings of one or more phishing attacks deployed against the computer network based on the collected target entity data,

wherein setting the timings includes:

identifying one or more network communication traffic times over the network;

selecting a deployment time for the one or more phishing attacks that is aligned with a highest network communication traffic time of the one or more network communication traffic times.

14. The method of claim 5 , wherein

the one or more target users comprise a plurality of target users of the computer network;

the method further comprises:

classifying the plurality of target users into high-access targets and low-access targets based on the collected target entity data.

15. The method of claim 6 , wherein

setting the level of difficulty of the phishing assessment is further based on the classification of the one or more target users, and wherein

the level of difficulty of the phishing assessment is set to a sophistication level above a sophistication threshold based on a high-access classification of the one or more target users.

16. The method of claim 6 , wherein

setting the level of difficulty of the phishing assessment is further based on the classification of the one or more target users, and wherein

the level of difficulty of the phishing assessment is set to a sophistication level below a sophistication threshold based on a high-access classification of the one or more target users.

17. The method of claim 5 further comprising:

identifying one or more communication vectors associated with the one or more target users of the computer network based on the collected target entity data; and

configuring the one or more communication vectors on a per-target user basis based on usage of the one or more communication vectors by each of the one or more target users.

18. The method of claim 5 , further comprising:

adjusting the level of testing difficulty of the phishing assessment based on responses to one or more phishing attacks of the phishing assessment collected from the one or more target users,

wherein the level of testing difficulty of the phishing assessment is increased if the one or more target users do not succumb to the one or more phishing attacks.

19. The method of claim 5 , further comprising:

adjusting the level of testing difficulty of the phishing assessment based on responses to one or more phishing attacks of the phishing assessment collected from the one or more target users,

wherein the level of testing difficulty of the phishing assessment is decreased if the one or more target users succumb to the one or more phishing attacks.

20. A method for testing a susceptibility of a computer network to phishing attacks, the method comprising:

at a web-based software platform implementing by one or more web computing servers:

initializing the phishing assessment, wherein the initializing includes:

collecting target entity data based on receiving an input of a target entity associated with the computer network; and

dynamically generating phishing attack constructs based on an input of the target entity data, wherein the phishing attack constructs comprise one or more fictitious attack domain names and one or more fictitious attack web pages, and wherein the one or more fictitious attack domain names are dynamically generated by modifying a target domain name;

configuring the phishing assessment, wherein the configuring includes:

setting an attack schedule for deploying one or more phishing attacks of the phishing assessment;

setting a testing duration of the phishing assessment;

determining a rating for each of the one or more fictitious attack domain names according to probable phishing attack effectiveness; and

setting a level of testing difficulty from a plurality of conditional levels of difficulty for the phishing assessment, wherein the level of testing difficulty is based on at least the ratings of fictitious attack domain names; and

testing for vulnerabilities in the computer network by deploying the configured phishing assessment using the dynamically generated phishing attack constructs according to [i] the attack schedule, [ii] the testing duration, and [iii] the level of difficulty.