Message platform for automated threat simulation, reporting, detection, and remediation
摘要
說明書
Alternatively, or in addition, a message may be set to be inaccessible to the reporting individual upon it being reported (or otherwise quarantined) and remain in such status until there is a resolution to the status of the message. If the message is determined not to be a phishing message, it is returned to a normal accessible status. If it is determined to be a phishing message, then the message can be deleted or moved into “Junk” folder or such action be taken.
The system can determine whether or not the message being reported is a simulated phishing message generated by the system. Generally, the system breaks down the reported message into message components. As non-limiting examples, message components are a header, a body, attachments, and URLs contained in the message, or any combination thereof. The overall process uses these components to: 1) find a specified header key, 2) decode and/or decrypt the value for the header key, 3) if the decode and/or decrypt was successful, get a tracking URL encoded in the header, and 4) determine if the message is a known simulated phishing attack based on whether or not the decode and/or decrypt was successful. The determination of whether or not the message being reported is a simulated phishing message generated by the system can be performed at the client device where the message is received for access by a user, or at a remote device, such as the network server device, or at both devices. The steps of the determination may also be split between multiple devices, such as the client device and the remote device.
