[{"text_idx": "#000004", "text": "Phishing is a form of social engineering that aims to trick people into disclosing sensitive information or gain access to systems by stealing log-on credentials."}, {"text_idx": "#000005", "text": "Phishing is by far the most prominent type of cybercrime (FBI report, 2020 p19) and is the number one cause of data breaches (Data Breach Investigations Report, 2020 p.13)."}, {"text_idx": "#000006", "text": "The most common form of phishing attack is email. Attackers will craft an email that will try to get you to click on malicious links or ask for personal information, such as credit card numbers."}, {"text_idx": "#000007", "text": "What is a phishing simulation?"}, {"text_idx": "#000008", "text": "A phishing simulation is a common measure organisations use to raise awareness of phishing and digital security in general. It involves sending a \u201cfake\u201d phishing email that includes a link. Those who click on the link are informed they are part of the simulation and are asked to complete training."}, {"text_idx": "#000010", "text": "In September of 2021 we used Sophos Phish Threat to send a phishing simulation to all Cardiff Met staff. The email informed staff about a new HR system and asked them to follow a link to activate their account. The link led to the training, but in a real attack it would lead to malicious site that would attempt to harvest personal details or usernames and passwords."}, {"text_idx": "#000011", "text": "The email was characteristic of a real attack, in that it included:"}, {"text_idx": "#000012", "text": "An urgent call to action \u2013 \u201cyou must actviate [sic] your account in the next seven days\u201d.\nA suspicious link \u2013 hovering your mouse over the link would have revealed a suspicious link.\nPoor spelling and grammar \u2013 the email is not well written and contains spelling mistakes.\nMismatched email domain \u2013 the sender\u2019s domain was myhr-portal.site, which is not a Cardiff Met domain."}, {"text_idx": "#000013", "text": "In fact, the email was a spear phishing attack. Spear phishing is targeted phishing; attackers use characteristics of the recipient and/or organisation to appear more legitimate. In this simulation you were addressed by your last name and the email referred to an upgrade of the HR system, which actually happened earlier this month."}, {"text_idx": "#000014", "text": "What should I have done?"}, {"text_idx": "#000015", "text": "If you think you have received a phishing or spear phishing email:"}, {"text_idx": "#000016", "text": "DO NOT click links in the email or open attachments"}, {"text_idx": "#000017", "text": "A convenient way to report an email to the Helpdesk is to use the Report Message button that is available in Outlook."}, {"text_idx": "#000018", "text": "Paranoia is the best position, if you are not sure, report it."}, {"text_idx": "#000019", "text": "Why are you trying to trick us?"}, {"text_idx": "#000020", "text": "Our intention was not to trick you or catch you out, but instead raise awareness and resilience to phishing attacks and improve Cardiff Met\u2019s cyber security."}, {"text_idx": "#000021", "text": "Phishing simulations and associated training have proven to raise awareness of cybersecurity (Chatchalermpun and Daengsi, 2021), contribute to \u201ccultivating user's resistance to phishing attacks\u201d (Jansson and Solms, 2013) with Gordon et al. (2019) suggesting that the simulation alone (without the training) reduces click rates and thus the threat to the organisation."}, {"text_idx": "#000023", "text": "We will let you know the results of the Cardiff Met simulation, e.g. how many people clicked the link, how many reported the message later this year, so keep an eye on the Insite portal for an article."}, {"text_idx": "#000029", "text": "Ym mis Awst 2021 cynhaliodd Met Caerdydd efelychiad gwe-rwydo i godi ymwybyddiaeth o we-rwydo a'r bygythiad difrifol y gall ei beri i seiberddiogelwch y brifysgol. Mae'r erthygl fer hon yn esbonio ychydig am yr efelychiad a pham y gwnaethom ei redeg."}, {"text_idx": "#000031", "text": "Mae gwe-rwydo yn fath o beirianneg gymdeithasol sy'n ceisio twyllo pobl i ddatgelu gwybodaeth sensitif neu gael mynediad at systemau trwy ddwyn manylion mewngofnodi."}, {"text_idx": "#000032", "text": "Gwe-rwydo yw'r math amlycaf o seiberdroseddu o bell ffordd ( adroddiad FBI, 2020 t19) a dyma brif achos torri data ( Adroddiad Ymchwiliadau Torri Data, 2020 t.13)."}, {"text_idx": "#000033", "text": "Y math mwyaf cyffredin o ymosodiad gwe-rwydo yw trwy e-bost. Bydd ymosodwyr yn creu e-bost a fydd yn ceisio eich annog i glicio ar ddolenni maleisus neu ofyn am wybodaeth bersonol, megis rhifau cardiau credyd."}, {"text_idx": "#000034", "text": "Mae efelychiad gwe-rwydo yn fesur cyffredin y mae sefydliadau'n ei ddefnyddio i godi ymwybyddiaeth o we-rwydo a diogelwch digidol yn gyffredinol. Mae'n cynnwys anfon e-bost gwe-rwydo \u201cffug\u201d sy'n cynnwys dolen. Hysbysir y rhai sy'n clicio ar y ddolen eu bod yn rhan o'r efelychiad a gofynnir iddynt gwblhau hyfforddiant."}, {"text_idx": "#000036", "text": "Ym mis Medi 2021 gwnaethom ddefnyddio Bygythiad Gwe-rwydo Sophos i anfon efelychiad gwe-rwydo i holl staff Met Caerdydd. Hysbysodd yr e-bost staff am system AD newydd a gofynnodd iddynt ddilyn dolen i actifadu eu cyfrif. Arweiniodd y cyswllt at yr hyfforddiant, ond mewn ymosodiad go iawn byddai'n arwain at safle maleisus a fyddai'n ceisio cynaeafu manylion personol neu enwau defnyddwyr a chyfrineiriau."}, {"text_idx": "#000037", "text": "Roedd yr e-bost yn nodweddiadol o ymosodiad go iawn, yn yr ystyr ei fod yn cynnwys:"}, {"text_idx": "#000038", "text": "Galwad frys i weithredu - \u201crhaid i chi actifadu eich cyfrif yn ystod y saith niwrnod nesaf\u201d.\nDolen amheus - byddai hofran eich llygoden dros y ddolen wedi datgelu dolen amheus.\nSillafu a gramadeg gwael - nid yw'r e-bost wedi'i ysgrifennu'n dda ac mae'n cynnwys camgymeriadau sillafu.\nParth e-bost ddim yn cyfateb i\u2019r un gywir - parth yr anfonwr oedd myhr-portal.site, nid yw'n barth Met Caerdydd."}, {"text_idx": "#000039", "text": "Mewn gwirionedd, ymosodiad gwe-drywanu oedd yr e-bost. Gwe-rwydo wedi'i dargedu yw gwe-drywanu; mae ymosodwyr yn defnyddio nodweddion y derbynnydd a/neu'r sefydliad i ymddangos yn fwy dilys. Yn yr efelychiad hwn fe'ch cyfeiriwyd atoch gyda\u2019ch enw cyntaf a chyfeiriodd yr e-bost at uwchraddiad sydd ar ddod o'r system AD, a fydd yn digwydd yn ddiweddarach eleni mewn gwirionedd."}, {"text_idx": "#000040", "text": "Beth ddylwn i fod wedi'i wneud?"}, {"text_idx": "#000042", "text": "PEIDIWCH a\u0302 chlicio dolenni yn yr e-bost neu agor atodiadau"}, {"text_idx": "#000044", "text": "Mae bod yn amheus yn peth doeth, os nad ydych yn siw\u0302r am e-bost, rhowch wybod i ni amdani."}, {"text_idx": "#000045", "text": "Pam ydych chi'n ceisio ein twyllo?"}, {"text_idx": "#000046", "text": "Nid eich twyllo neu eich dal chi allan oedd ein bwriad, ond yn hytrach codi ymwybyddiaeth a cydnerthedd i ymosodiadau gwe-rwydo a gwella seiberddiogelwch Met Caerdydd."}, {"text_idx": "#000047", "text": "Mae efelychiadau gwe-rwydo a hyfforddiant cysylltiedig wedi profi i godi ymwybyddiaeth o seiberddiogelwch (Chatchalermpun a Daengsi, 2021), cyfrannu at \u201cfeithrin ymwrthedd defnyddiwr i ymosodiadau gwe-rwydo\u201d (Jansson and Solms, 2013) gyda Gordon et al. (2019) sy'n awgrymu bod yr efelychiad yn unig (heb yr hyfforddiant) yn lleihau cyfraddau clicio ac felly'r bygythiad i'r sefydliad."}, {"text_idx": "#000049", "text": "Byddwn yn rhoi gwybod i chi am ganlyniadau efelychiad Met Caerdydd, e.e. faint o bobl a gliciodd y ddolen, faint a adroddodd y neges yn hwyrach eleni, felly cadwch lygad ar borth Insite am erthygl."}]