Methods and systems for preventing malicious use of phishing simulation records
Described herein are methods, network devices and machine-readable media for preventing the malicious use of phishing simulation records. Phishing simulation records often times can reveal which individuals are most susceptible to phishing attacks. In the event that an attacker gains access to these records, the attacker can exploit such information to send phishing attacks to those individuals who are the most susceptible. To address such vulnerabilities, a phishing simulation record of an individual is only associated with an e-mail alias of the individual. Further, such e-mail alias may be deactivated after phishing simulations have been completed. Therefore, even if an attacker were able to identify individuals most susceptible to phishing attacks, the attacker will be unable to send any phishing attacks to those individuals since their e-mail aliases will have been deactivated.
1. A method, comprising:
for each individual, associating a phishing simulation record of the individual with an e-mail alias of the individual;
determining which of the phishing simulation records satisfies a criterion;
selecting at least one of the phishing simulation records which satisfies the criterion; and
for each of the selected phishing simulation records, sending one or more messages to the individual associated with the selected phishing simulation record via that individual's e-mail alias,
wherein after sending the one or more messages, at least one of the e-mail aliases becomes invalid, preventing one or more of the individuals whose e-mail aliases have become invalid from receiving any further messages from their respective e-mail aliases while their respective e-mail aliases are invalid.
2. The method of claim 1 , wherein each of the phishing simulation records comprises a measure of the corresponding individual's susceptibility to phishing attacks.
3. The method of claim 2 , wherein the criterion is satisfied if the measure of the corresponding individual's susceptibility to phishing attacks exceeds a threshold.
4. The method of claim 1 , wherein each of the phishing simulation records comprises a total number of phishing simulations that the corresponding individual has fallen victim to.
5. The method of claim 4 , wherein the criterion is satisfied if the total number of phishing simulations that the corresponding individual has fallen victim to exceeds a threshold.
6. The method of claim 1 , further comprising:
for each of the individuals, associating the e-mail alias of the individual with a primary e-mail address of the individual.
7. The method of claim 6 , wherein the association between the e-mail aliases and the primary e-mail addresses is stored using encryption.
8. The method of claim 6 , wherein the association between the phishing simulation records and the e-mail aliases is stored in a first data store and the association between the e-mail aliases and the primary e-mail addresses is stored in a second data store, the first data store being separate from the second data store so that even if an attacker gains access to the first data store, the attacker does not automatically gain access to the second data store.
9. The method of claim 6 , further comprising:
upon detecting that one or more messages have been sent to an individual's e-mail alias, forwarding the one or more messages to the primary e-mail address of the individual.
10. The method of claim 6 , wherein the at least one of the e-mail aliases becomes invalid upon terminating any forwarding of messages from the at least one of the e-mail aliases to their corresponding primary e-mail addresses.
11. The method of claim 1 , wherein the one or more messages comprise one or more of phishing simulations and training materials constructed to increase an individual's awareness of phishing attacks.
12. The method of claim 6 , wherein, for each of the individuals, the phishing simulation record of the individual is associated with the primary e-mail address of the individual only through the e-mail alias of the individual.
13. A network device, comprising:
a processor;
a storage device connected to the processor; and
a set of instructions on the storage device that, when executed by the processor, cause the processor to:
for each individual, associate a phishing simulation record of the individual with an e-mail alias of the individual;
determine which of the phishing simulation records satisfies a criterion;
select at least one of the phishing simulation records which satisfies the criterion; and
for each of the selected phishing simulation records, send one or more messages to the individual associated with the selected phishing simulation record via that individual's e-mail alias,
wherein after sending the one or more messages, at least one of the e-mail aliases becomes invalid, preventing one or more of the individuals whose e-mail aliases have become invalid from receiving any further messages from their respective e-mail aliases while their respective e-mail aliases are invalid.
14. A non-transitory machine-readable storage medium comprising software instructions that, when executed by a processor, cause the processor to:
for each individual, associate a phishing simulation record of the individual with an e-mail alias of the individual;
determine which of the phishing simulation records satisfies a criterion;
select at least one of the phishing simulation records which satisfies the criterion; and
for each of the selected phishing simulation records, send one or more messages to the individual associated with the selected phishing simulation record via that individual's e-mail alias,
wherein after sending the one or more messages, at least one of the e-mail aliases becomes invalid, preventing one or more of the individuals whose e-mail aliases have become invalid from receiving any further messages from their respective e-mail aliases while their respective e-mail aliases are invalid.