Phishing Awareness: Learning through realistic simulation

Treppenbau Bünning, headquartered in Osdorf in Schleswig-Holstein, is a medium-sized craft business with 28 employees that specialises in the construction of staircases.

‘We can't produce without our IT. We wouldn't survive for long without it’ summarises Managing Director Nicole Bünning. In the world of Treppenbau Bünning, where three CNC machines and a sophisticated chaotic warehouse for wooden panels ensure precision and efficiency on a daily basis, the digital infrastructure has long since become the centrepiece of the company and a decisive factor for the company's success. Due to this comprehensive digitalisation, cyber security is of crucial importance for the company.

Specifically, the topic was phishing emails. These days, they are often so well designed that they are difficult to recognise. Due to the quick click and sometimes fleeting reading behaviour in everyday working life, recipients are easily tempted to click on a link in the email. 

One year after the last training course, she wanted to check how well the employees were prepared for such cyberattacks. She therefore turned to Tim Gellersen from EDIH.SH to carry out a realistic test.

The challenge was to test and improve employees' awareness and responsiveness to phishing emails. 

1. High dependency on digital infrastructure: The CNC machines and the chaotic panel warehouse are essential for production and require a stable and secure IT environment.

2. Increasing risk of cyberattacks: As digitalisation increases, so does the risk of cyberattacks, particularly from phishing emails.

3. Lack of awareness and insufficient employee training: One year after the last IT security training, there was uncertainty as to how well employees would react to phishing attacks.

Treppenbau Bünning, with the help of EDIH.SH followed a well defined process:

1.  Conducting a realistic phishing test:

   Tim Gellersen from EDIH.SH designed a phishing test. EDIH.SH developed a deceptively real-looking phishing email and sent it to all relevant employees - from the workshop to the office, field service and management - using the specified recipient list. The exact timing of the mailing was kept secret to ensure that the employees' reactions were spontaneous and unbiased.

   The email is crafted by ChatGPT and inquires about the feasibility of a design that is supposedly stored in a Google Drive, with the link provided in the email. However, instead of a Google Drive link, the email contains a hyperlink to a different site. The link in the email says "google.dive.com/adasb2," but in reality, it redirects to a different URL that is not a Google link and bears no resemblance to one.

   This situation is meant to raise suspicion in the reader and discourage them from clicking on the link.

   We have set up a minimalist server to which the link in the email redirects. This server hosts a simple webpage with tips on how to protect oneself from phishing. Additionally, the server tracks all requests made to the site.

   Each phishing email contains an anonymized identifier, a random string that is unique to each person, allowing us to see how many different people clicked on the link in the email, without revealing their identities to protect privacy.

2. Analysis of the results:

   The test showed that 75% of employees clicked on the phishing email. This high click rate indicated a significant security gap and a lack of awareness of phishing threats.

3. Immediate training measures:

   In response to the test results, EDIH.SH conceptualised and implemented a qualification measure. This training aimed to train employees in recognising and correctly handling phishing emails.

The phishing test showed that 75% of employees clicked on the link in the phishing e-mail. This click rate is too high and represents a significant security gap. This indicates that a large proportion of employees have difficulty distinguishing fake emails from legitimate ones.

This high susceptibility to phishing attacks is due to several factors:

• Routine and habit: In the flow of daily tasks, employees often click on links reflexively, without considering potential security risks. This habitual behavior makes them prime targets for phishing schemes.

• Lack of awareness & casual reading behaviour: Many employees have limited cybersecurity awareness and tend to skim emails without carefully evaluating their content, leaving them vulnerable to deception.

• Deceptively genuine phishing emails: Phishing attempts have become increasingly sophisticated, mimicking legitimate communications so convincingly that even cautious employees may be misled.

These factors increase the risk of cyber-attacks and emphasise the need for urgent action to improve IT security.

Impact on the customer's work

• Stronger safety culture: The test and subsequent training lead to a stronger security culture within the organisation. Employees are now more vigilant and cautious when dealing with emails and other digital communication tools.

• Increased cyber security: Treppenbau Bünning can significantly improve IT security in the company. A conscious approach to phishing emails reduces the risk of data loss, production downtime and financial damage caused by cyber attacks.

• Sustainability: Treppenbau Bünning has recognised that raising awareness is an ongoing issue. Cybersecurity needs to be regularly refreshed and constantly focussed on in order to be effective in the long term and to raise awareness of potential threats. This contributes to the security and stability of the company in the long term.

Implications for the work of the EDIH

• Measuring success and best practices: The success at Treppenbau Bünning serves the EDIH.SH as a case study and best practice example for future training programmes at other companies.

• Further development of the training programmes: The experience and feedback from this project will be incorporated into the further development and optimisation of EDIH.SH's training programmes.