Overview... 3 Provisioning Sites for Security Awareness Training... 3 Understanding Phishing Simulations... 6 Understanding Types...

Size: px

Start display at page:

Download "Overview... 3 Provisioning Sites for Security Awareness Training... 3 Understanding Phishing Simulations... 6 Understanding Types..."

Oswald Parks
6 years ago
Views:

2 Overview... 3 Provisioning Sites for Security Awareness Training... 3 Understanding Phishing Simulations... 6 Understanding Types... 6 Understanding Programs and Campaign Scheduling... 6 Welcome Phishing Campaign... 7 Training Campaign... 8 Campaign Summary Reports... 9 Saving Custom Templates Understanding Events Managing Spam Filters Whitelisting s in Office Whitelisting s in Google Apps Whitelisting s in AppRiver Whitelisting s in Mimecast Whitelisting s in Exchange 2013 or Exchange Page Webroot Inc. All rights reserved. Proprietary and Confidential Information March 22, 2018

As our client, you will be able to build your phishing simulations through our easy to use Simulation Wizard.

Add your bait email and lure page by either choosing from our pre-canned templates, or writing your own content.

Watch reports in real-time: Email processing and delivery Email opens and clicks Data post attempts to the lure page To

creating a new site. Enable for an existing site. To enable provisioning for a new site: 1.

3 As our client, you will be able to build your phishing simulations through our easy to use Simulation Wizard. Using the wizard, you will be able to: Import your company s target list. Add your bait and lure page by either choosing from our pre-canned templates, or writing your own content. Send a test to test the simulation. Schedule and launch your simulation against your targets. Watch reports in real-time: processing and delivery opens and clicks Data post attempts to the lure page To enable Webroot Security Awareness Training within the web console, you can do either of the following: Provision when creating a new site. Enable for an existing site. To enable provisioning for a new site: 1. Select the Enable Security Awareness Training checkbox on the final step of new site creation. 2. Click the Finish button. Page Webroot Inc. All rights reserved. Proprietary and Confidential Information March 22, 2018

4 To enable provision for an existing site: 1. For the site you want to enable, click the Manage button. 2. Click the Security Awareness Training tab. 3. Select the Enable Security Awareness Training checkbox. 4. Select Full or Free 30 Day Trial radio button. 5. Click the Save Changes button. Page Webroot Inc. All rights reserved. Proprietary and Confidential Information March 22, 2018

Additionally, in the Site tab, you can launch the Security Awareness Training console by clicking on the Go To Security

5 6. At any time, under the Security Awareness Training tab, you can view the Security Awareness Training status and target user count. 7. After the settings are saved, as needed, click the Go To Security Awareness Console button. 8. Additionally, in the Site tab, you can launch the Security Awareness Training console by clicking on the Go To Security Awareness Training Console button. Page Webroot Inc. All rights reserved. Proprietary and Confidential Information March 22, 2018

By default, phishing simulations are only available to launch against your authorized domains. You will not be able to target email addresses outside of your authorized domains list.

Before running any simulations against your organization, you should consult with your company s IT and/or security team to alert them of the tests, and maximize the success of your simulation.

6 By default, phishing simulations are only available to launch against your authorized domains. You will not be able to target addresses outside of your authorized domains list. These types of tests are generally ran by your company IT or security team. Before running any simulations against your organization, you should consult with your company s IT and/or security team to alert them of the tests, and maximize the success of your simulation. If you are a security consultant, you can contact us to become a verified security consultant to launch campaigns for your clients. Note: addresses on ISP or public domains etc.,) are restricted and cannot be used within the Securecast service. Target addresses must be valid company or organization addresses. There are two types of addresses that you enter: Authorized Domain Address (Admin) This is your own address on your company s or organization s domain. When you add an Authorized Domain address, you will be sent a validation link to your inbox. Click that link to verify that you are the owner of the box, and have an account on your company s/organization s domain. This will allow you to import target addresses on that domain. Target Addresses (End-Users) These are your company s or organization s employee s or member s addresses that you will target your simulation toward. These are needed by the simulation in order to deliver the bait . Programs is a feature set that allows you to schedule multiple campaign tasks with the goal of helping automate your training program. Tasks available for scheduling include: Welcome s are generally used for sending out an introduction to your new Security Awareness program to end users, management, IT staff, etc. You can use the Welcome task as the first introductory to your users or consider scheduling it after your first Phishing Campaign to introduce Security Awareness after a baseline phishing simulation has been run. Welcome s are also a new template type and can be created, edited and managed under Settings > in the menu. This is an task that can be scheduled at a date and time you specify by populating the Send Date field. Page Webroot Inc. All rights reserved. Proprietary and Confidential Information March 22, 2018

To create a new Welcome Email Template: 1. Click the New Email Template button. 2. Under the Settings > Email menu, enter Welcome Email.

You can schedule multiple phishing campaign tasks to help automate your security awareness program. To create a phishing campaign: 1.

From the Campaign drop-down menu, select the phishing campaign you want to schedule. 2.

7 To create a new Welcome Template: 1. Click the New Template button. 2. Under the Settings > menu, enter Welcome . This task will schedule a phishing campaign to be run at a date and time you specify. You can schedule multiple phishing campaign tasks to help automate your security awareness program. To create a phishing campaign: 1. Do one of the following: In the Task field, enter a unique name for the campaign. From the Campaign drop-down menu, select the phishing campaign you want to schedule. 2. Populate the Start Date field to set the date and time you want to send your Phishing Campaign. 3. Populate the End Date field to determine when to complete the campaign and finalize reporting. Page Webroot Inc. All rights reserved. Proprietary and Confidential Information March 22, 2018

8 4. Select recipient targets can be selected from the picker individually or by entering tags. 5. Select the Send report after this campaign closes checkbox to schedule a campaign summary report to be sent to addresses you enter. Note: Phishing campaigns are scheduled using Programs and can be created and configured using Campaigns or Create New Campaign options in the menu. This task will schedule a training campaign to be run at a date and time you specify very similar to a phishing campaign. You can schedule multiple training campaign tasks to help automate your security awareness program. To create a training campaign: 1. Do either of the following: When creating a new training campaign, enter a unique name. From the Campaign drop-down menu, select the existing training campaign you want to schedule. 2. Populate the Start Date field to set the date and time you want to send your Training Campaign. 3. Populate the End Date field to determine when to complete the campaign and finalize reporting. 4. Select recipient targets can be selected from the picker individually or by entering tags. 5. Select the Send report after this campaign closes checkbox to schedule a campaign summary report to be sent to addresses you enter. Note: Training campaigns are scheduled using Programs and can be created and configured using Campaigns or Create New Campaign options in the menu. Page Webroot Inc. All rights reserved. Proprietary and Confidential Information March 22, 2018

The campaign summary report is a report in PDF format that contains a summary of important details about the campaign run including the following: Name of campaign Date of campaign Key statistics,

9 The campaign summary report is a report in PDF format that contains a summary of important details about the campaign run including the following: Name of campaign Date of campaign Key statistics, along with a summary of the campaign templates used To send a campaign summary report at the conclusion of a phishing or training campaign, follow this procedure. To send a campaign: 1. Select the Send a report after this campaign closes checkbox. 2. Click the Add button to determine who will receive the report. 3. To add multiple recipients, clicking the Add button again to expand additional recipient settings boxes. This is an optional step. Note: Reports can be sent to any valid address including distribution lists. Page Webroot Inc. All rights reserved. Proprietary and Confidential Information March 22, 2018

New Program Screen Populated programs Screen Page 10 2018 Webroot Inc.

You can use templates to edit an existing template, or create a

You will be able to see data about the following types of email events

application, or mail client via SMTP Relay or the API that the emailer

Clicks Whenever a recipient clicks one of the Click Tracked links in

Opens Whenever an email is opened by a recipient.

contact on that email is in one of your suppression groups.

11 You can use templates to edit an existing template, or create a template from scratch within the template editor. To save a custom template: 1. Select the Save as template checkbox. 2. Enter a name for your template. 3. Click the Save this as a template button. You will be able to see data about the following types of events in the Activity Feed: Processed Requests from your website, application, or mail client via SMTP Relay or the API that the er processed. Clicks Whenever a recipient clicks one of the Click Tracked links in your . Delivered An that was delivered to a recipient. Opens Whenever an is opened by a recipient. Deferred The recipient mail server asked the er to stop sending s so quickly. Drops The er drops an when one of the following occurs: The contact on that is in one of your suppression groups. The recipient previously bounced. The recipient has marked your as spam. Bounces When an attempt is made to deliver an , but the recipient mail server rejects it. Spam Reports Whenever a recipient marks your as spam and their mail server tells us about it. Page Webroot Inc. All rights reserved. Proprietary and Confidential Information March 22, 2018

Some spam filters may bounce mail coming from Webroot Security Awareness Training, which is both good and bad.

If mail does bounce, you may need to whitelist the send mail server by IP address or server name or you can also

Add a white list for one of the following: Securecast IP Address: 167.89.85.54 Securecast Mail Server: o1.relay.

54]) Securecast sending domain(s): use sending domain you set up/choose To whitelist in Office 365: 1.

12 Some spam filters may bounce mail coming from Webroot Security Awareness Training, which is both good and bad. It s good for proving that your spam filter is working, but it s bad for phishing awareness purposes. If mail does bounce, you may need to whitelist the send mail server by IP address or server name or you can also whitelist the sending domain. To whitelist the send server: 1. Log into your gateway/spam filter. 2. Add a white list for one of the following: Securecast IP Address: Securecast Mail Server: o1.relay.mx-secure.com (o1.relay.mx-secure.com [ ]) Securecast sending domain(s): use sending domain you set up/choose To whitelist in Office 365: 1. Log into your Office 365 and click on the Admin Portal. 2. Select Admin Centers > Exchange. Page Webroot Inc. All rights reserved. Proprietary and Confidential Information March 22, 2018

13 3. Select Connection Filter under the Protection section. 4. Click on Connection Filter, then click the Pencil icon to edit the connection filter policy. 5. Under the IP Allow List, click the + (plus) sign to add an IP address. Page Webroot Inc. All rights reserved. Proprietary and Confidential Information March 22, 2018

14 6. Add the following IP address: Click OK, then click Save. To whitelist in Google Apps: 1. Log in to the Google Apps admin portal. 2. Select Apps. 3. Select G Suite. Page Webroot Inc. All rights reserved. Proprietary and Confidential Information March 22, 2018

This change may take up to 60 minutes to propagate. To whitelist in AppRiver: 1. Log in to the AppRiver Admin Center. 2.

15 4. Select Gmail. 5. Select Advanced Settings. 6. In the Organizations section, highlight your domain. 7. In the Whitelist section, enter the following IP address: Scroll to the bottom and click Save. This change may take up to 60 minutes to propagate. To whitelist in AppRiver: 1. Log in to the AppRiver Admin Center. 2. Select Filters > IP Addresses. 3. Under Allowed IP Addresses, add the following IP address: Click Save. Page Webroot Inc. All rights reserved. Proprietary and Confidential Information March 22, 2018

16 When using Mimecast, you will need to create a new Permitted Sender policy. Note: Make sure that you do not edit the existing default policy. To whitelist in Mimecast: 1. Log in to the Administration Console. 2. From the menu, select Administration. 3. Select Gateway > Policies. 4. Click the New Policy button. 5. Under Options, name your policy. 6. From the drop-down menu, select Permit Sender. 7. Under s From, select the following: Addresses Based On Both Applies From Everyone Specifically Applies to all Senders 8. Under s To, select the following: Applies To Everyone Specifically Applies to all Recipients 9. Under Validity, select the following: Enable, Set policy as perpetual Always On The Policy Override checkbox. 10. For Source IP Ranges, enter the Securecast gateway IP: Save the policy. This new policy may take up to 30 minutes to take effect. Page Webroot Inc. All rights reserved. Proprietary and Confidential Information March 22, 2018

17 To whitelist in Exchange: 1. Open the Exchange Management shell. 2. Run the following command: Add-IPAllowListEntry -IPAddress Page Webroot Inc. All rights reserved. Proprietary and Confidential Information March 22, 2018

Integrating Trend Micro Hosted Security with Google Gmail

A Trend Micro Integration Guide I November 2017 Integrating Trend Micro Hosted Email Security with Google Gmail» This guide provides the steps necessary to configure Google Gmail to work with Trend Micro