Re: attempts sending fake phishing messages to students and/or employees

[Andrew Daviel <advax () TRIUMF CA>]

I thought about doing this, but was shot down by colleagues for reasons 
others mentioned. We have also had some real incidents to use, and 
responded with announcements, posters, and an article in a (paper) 
newsletter. We had about 0.3% of users fall for a somewhat tailored phish 
(had our institution name and website, but not copied from a real 
announcement).

An observation - it seems to be the older, less net-savvy users who seem 
more likely to fall for these. They get less spam (probably from never 
posting on forums/newslists), so aren't "inoculated", and don't visit 
information websites etc. We have some emeritus staff who may work less 
hours, or at home, and so are less likely to ask a colleague if a 
phishing message is legitimate. Educating these people is a problem.

--
Andrew Daviel, TRIUMF, Canada