Design the campaign
Regardless of which tool you use, there are two main steps that make up an internal phishing campaign.
First, you must decide whether you want to mimic your own organization’s email domain or use a similar domain that’s made up of misspellings or other differentiators, such as adding the suffix tech to the end of your domain — your@domaintech.com. A similar domain name includes indicators that your users should pick up on once they receive the email.
Once you choose the domain, you must come up with a compelling message to lure users into doing something they shouldn’t do, such as clicking a link, downloading and opening an attachment, or providing login credentials. Messages that look like they’re coming from a manager or executive within the organization requesting that users do something within a certain time frame are typically successful.
Dear Colleague:
As part of our nationaly-certified Women’s Business Enterprise initiatives, we need to solicit your feedback to the exec committee about the busines and how it operates. Please visit this link to the survey here today to let us know what you think.
Regards,
Chris Smith, SHRM-SCP — HR Director
This urgent email from a business director that affects people personally is an excellent example of an email in an internal phishing campaign. Your users will often follow the instructions without thinking about what they’re doing. The next thing you know, they’ve submitted their network login credentials or other sensitive information that the email prompted them for.
Another approach is to notify your users that they have a file ready for download from one of the popular cloud-based file sharing services, such as Dropbox.
Once the user takes the specific action you’re soliciting, you can end the internal phishing campaign or redirect them to an awareness website so they can learn more about the choices they made.
Make the incident a teachable moment, but do so in a way that’s not demeaning. Getting management or your security committee involved is critical because it demonstrates that phishing security is an organization-wide issue rather than just a criticism from IT.