Determining authenticity of reported user action in cybersecurity risk assessment
An electronic device will identify an electronic message received by a messaging client that is associated with a first recipient, and it will analyze the electronic message to determine whether the electronic message is a simulated malicious message. Upon determining that electronic message is a simulated malicious message, the device will identify an actuatable element in the electronic message. The actuatable element will include a service address. The device will modify the electronic message by appending a user identifier of the first recipient to the service address of the actuatable element. Then, when the actutable element is actuated, the system may determine whether the first recipient actuated the actuatable element or an alternate recipient did so based on whether the user identifier of the first recipient is still appended (or is the only user identifier appended) to the actuatable element.
1. A method of verifying authenticity of a user-reported action in a cybersecurity testing campaign, the method comprising:
generating, by a message origination server, a simulated malicious message that includes an actuatable element, wherein the actuatable element includes a service address;
sending, by the message origination server, the simulated malicious message to an account of an intended recipient;
receiving, by a computing device associated with the account of the intended recipient, the simulated malicious message;
receiving, by the computing device associated with the account of the intended recipient, a command to forward the simulated malicious message to a second recipient different from the intended recipient;
determining, by the computing device associated with the account of the intended recipient, that the simulated malicious message is simulated;
in response to determining that the simulated malicious message is simulated:
identifying, by the computing device associated with the account of the intended recipient, the actuatable element in the simulated malicious message; and
modifying, by the computing device associated with the account of the intended recipient, the simulated malicious message by appending a first user identifier associated with the intended recipient to the actuatable element, resulting in a modified message with a modified actuatable element;
causing, by the computing device associated with the account of the intended recipient, the modified message with the modified actuatable element to be forwarded to the second recipient;
receiving, by a cybersecurity analyzer server, a service request for the service address;
determining, by the cybersecurity analyzer server, that the service request includes the first user identifier associated with the intended recipient and a second user identifier associated with the second recipient; and
in response to determining that the service request includes the first user identifier associated with the intended recipient and the second user identifier associated with the second recipient, determining, by the cybersecurity analyzer server, that the simulated malicious message was forwarded to the second recipient and not generating a record indicating that the intended recipient actuated the actuatable element.
2. The method of claim 1 , wherein generating the simulated malicious message that includes the actuatable element comprises:
generating the simulated malicious message so that the actuatable element includes a personalized service address; and
storing the personalized service address in a data store in association with the intended recipient.
3. The method of claim 1 , further comprising:
determining, by the cybersecurity analyzer server, whether the service request includes an authentication token; and
only generating, by the cybersecurity analyzer server, the record indicating that the intended recipient actuated the actuatable element if the service request includes the authentication token and the authentication token has a verifiable value, otherwise determining, by the cybersecurity analyzer server, that the simulated malicious message was intercepted and not generating a record indicating that the intended recipient actuated the actuatable element.
4. The method of claim 1 , wherein the message origination server and the cybersecurity analyzer server comprise elements of a common system.
5. The method of claim 1 , further comprising:
based on determining that the service request includes the first user identifier associated with the intended recipient and the second user identifier associated with the second recipient:
causing, by the cybersecurity analyzer server, a training action of a first type to be delivered to the second recipient, wherein the training action of the first type is a training action directed to training the second recipient to avoid falling victim to malicious messages; and
causing, by the cybersecurity analyzer server, a training action of a second type to be delivered to the intended recipient, wherein the training action of the second type is a training action directed to training the intended recipient to avoid forwarding malicious messages.
6. The method of claim 1 , wherein generating the simulated malicious message comprises:
including, in a header field of a header section of the simulated malicious message:
a key, and
a value that satisfies a first trusted sender rule.
7. The method of claim 1 , wherein determining that the simulated malicious message is simulated comprises:
determining whether any header field of a header section of the simulated malicious message starts with a predetermined key;
for any header field that starts with the predetermined key, analyzing that header field to determine whether a value that follows the predetermined key satisfies a first trusted sender rule; and
if the value that follows the predetermined key satisfies the first trusted sender rule, determining that the simulated malicious message originated from a trusted sender and is a simulated phishing message.
8. A messaging system comprising:
a message origination server comprising at least one hardware processor and memory, wherein the memory of the message origination server stores instructions that, when executed by the at least one hardware processor of the message origination server, cause the message origination server to:
generate a simulated malicious message that includes an actuatable element, wherein the actuatable element includes a service address; and
send the simulated malicious message to an account of an intended recipient; and
a computing device associated with the account of the intended recipient and comprising at least one hardware processor and memory, wherein the memory of the computing device stores instructions that, when executed by the at least one hardware processor of the computing device, cause the computing device to:
receive the simulated malicious message;
receive a command to forward the simulated malicious message to a second recipient different from the intended recipient;
determine that the simulated malicious message is simulated;
in response to determining that the simulated malicious message is simulated:
identify the actuatable element in the simulated malicious message; and
modify the simulated malicious message by appending a first user identifier associated with the intended recipient to the actuatable element, resulting in a modified message with a modified actuatable element;
cause the modified message with the modified actuatable element to be forwarded to the second recipient;
a cybersecurity analyzer server comprising at least one hardware processor and memory, wherein the memory of the cybersecurity analyzer server stores instructions that, when executed by the at least one hardware processor of the cybersecurity analyzer server, cause the cybersecurity analyzer server to:
receive a service request for the service address;
determine that the service request includes the first user identifier associated with the intended recipient and a second user identifier associated with the second recipient; and
in response to determining that the service request includes the first user identifier associated with the intended recipient and the second user identifier associated with the second recipient, determine that the simulated malicious message was forwarded to the second recipient and not generate a record indicating that the intended recipient actuated the actuatable element.
9. The system of claim 8 , wherein generating the simulated malicious message that includes the actuatable element comprises:
generating the simulated malicious message so that the actuatable element includes a personalized service address; and
storing the personalized service address in a data store in association with the intended recipient.
10. The system of claim 8 , wherein the memory of the cybersecurity analyzer server stores additional instructions that, when executed by the at least one hardware processor of the cybersecurity analyzer server, cause the cybersecurity analyzer server to:
determine whether the service request includes an authentication token; and
only generate the record indicating that the intended recipient actuated the actuatable element if the service request includes the authentication token and the authentication token has a verifiable value, otherwise determine that the simulated malicious message was intercepted and not generating a record indicating that the intended recipient actuated the actuatable element.
11. The system of claim 8 , wherein the message origination server and the cybersecurity analyzer server comprise elements of a common system.
12. The system of claim 8 , wherein the memory of the cybersecurity analyzer server stores additional instructions that, when executed by the at least one hardware processor of the cybersecurity analyzer server, cause the cybersecurity analyzer server to:
based on determining that the service request includes the first user identifier associated with the intended recipient and the second user identifier associated with the second recipient:
cause a training action of a first type to be delivered to the second recipient, wherein the training action of the first type is a training action directed to training the second recipient to avoid falling victim to malicious messages; and
cause a training action of a second type to be delivered to the intended recipient, wherein the training action of the second type is a training action directed to training the intended recipient to avoid forwarding malicious messages.
13. The system of claim 8 , wherein generating the simulated malicious message comprises:
including, in a header field of a header section of the simulated malicious message:
a key, and
a value that satisfies a first trusted sender rule.
14. The messaging system of claim 8 , wherein determining that the simulated malicious message is simulated comprises:
determining whether any header field of a header section of the simulated malicious message starts with a predetermined key;
for any header field that starts with the predetermined key, analyzing that header field to determine whether a value that follows the predetermined key satisfies a first trusted sender rule; and
if the value that follows the predetermined key satisfies the first trusted sender rule, determining that the simulated malicious message originated from a trusted sender and is a simulated phishing message.