Loading…
11
Why does nobody talk about how long it takes to fix a simple phishing filter rule?
I spent about 4 hours last Thursday trying to block a specific type of malicious link in our email system. The phishing emails looked legit with Microsoft branding and a fake login page. My first attempt flagged too many false positives and locked out some real emails from a vendor. Then I tweaked the rule and it caught nothing for two days. I finally realized the issue was the link encoding hiding the real URL behind a redirect service. Has anyone else dealt with a security rule that took way longer than expected to get right?
1 comments
Log in to join the discussion
Log In1 Comment
nancy9292mo ago
Oh yeah, "simple phishing filter rule" is a real joke (I laughed out loud at that). I spent an entire weekend once trying to block a fake DocuSign email that kept slipping through. My rule either blocked everything from that domain name or let the bad ones slide because they had some weird Unicode character in the subject line. The worst part was testing it - you know, you run a test email and it works, then nothing happens for three days until some VP gets phished. Your link encoding problem sounds like a nightmare honestly, I've been there with redirect services making my head spin.
7