Phishing Audit

Phishing is a type of cybercrime where a nefarious actor, posing as a legitimate person or business, attempts to lure an unsuspecting person or organization into sharing sensitive information. The information can then be used to access systems or important accounts — which can result in identity theft, data loss, and financial loss.

In classic email phishing attacks, cybercriminals send out mass emails — also known as a phishing campaign — to a large target audience of individuals’ personal accounts or company accounts. These mass phishing emails are often not personalized because they go to numerous people. Email phishing scams may attempt to entice recipients into clicking a link that leads them to a malicious webpage. These pages then attempt to trick recipients into providing their personal information or installing malicious files on their devices. The phishing email may also contain a malicious file or link to malicious content that may include viruses or malware.

The City’s Cybersecurity Awareness Training Program Improves Employee Behavior to a Limited Extent but Lacks Recommended Content and Not All Employees Complete Routine Training

We found employees who took all six city training courses offered in the first three quarters of 2020 were 9.6 percentage points less likely to submit sensitive information, such as their username and password, after receiving a phishing email compared to employees who took no training.

We also found that those who completed trainings recently performed better than those who had not. However, not all employees within the city complete cybersecurity training because the city has not yet identified which specific employees need to take it.

Technology Services Should Track Phishing Metrics and Communicate Them to Other City Agencies

We found the city’s Technology Services agency does not formally communicate phishing metrics to other City and County of Denver agencies.

1.1 Identify Employee Job Types – The Office of Human Resources should complete its work to accurately identify employees’ job types in Workday and better define the data associated with each job type.

Agency Response: Agree, Implementation Date – Dec. 31, 2021

1.2 Offer Training to the Correct Sets of Employees – Technology Services should work with the Office of Human Resources to gather the
necessary data to better define which employees should receive cybersecurity awareness trainings and ensure that those individuals are being offered training throughout the year.

Agency Response: Agree, Implementation Date – Dec. 31, 2022

1.3 Reconcile Trainings – Technology Services should reconcile the list of individuals who should receive trainings with a list of those who actually complete it through Workday Learning.

Agency Response: Agree, Implementation Date – June. 30, 2021

1.4 Evaluate Training Content – Technology Services should evaluate the content of the trainings it offers each quarter and each year to ensure the training is effective. It should make selections to improve employees’ behavior and knowledge. Specific reminders to use end-user tools, such as the “Report Phish” button, are recommended and should be in line with best practices. Trainings should include assessments to ensure employees understand the knowledge being taught and surveys should be provided to solicit employees’ feedback on the trainings.

Agency Response: Agree, Implementation Date – Dec. 31, 2022

1.5 Train Employees Every Six Months– Technology Services should train employees on a comprehensive set of phishing cues and do so at least once every six months. This should include such phishing cues as those noted in Appendix B of this report.

Agency Response: Agree, Implementation Date – Dec. 31, 2022

2.1 Develop Phishing Metrics– Technology Services should gather the information necessary to develop key phishing metrics that can be reported to other city agencies. This could include click rates, reporting rates, repeat offenders, etc.

Agency Response: Agree, Implementation Date – Sept. 30, 2021

2.2 Communicate Phishing Metrics– Once Technology Services develops phishing metrics, Technology Services should communicate the phishing metrics to other city agencies and explain why the metrics are being communicated to them and what to do with the metrics (e.g., identify areas of improvement for employees).

Agency Response: Agree, Implementation Date – Dec. 31, 2021

A follow-up report is forthcoming.