I didn't get how people end up entering paswords into randon places and click on suspicions links until I started to work for a big corp.
You get a lot of stuff in the inbox that doesn't exactly relate to your day to day work from departments you only vaguely heard about.
Then the UX of corporate stuff, especially one from microsoft is designed in a way to randomly jump in your face with a password prompt without you starting it actively. The session timeout here, kerberos prompt for smartcard here, the vpn hickup, teams needs to reconnect after the laptop gets out of sleep state. Then half of it random at some point updates and looks subtly different too.
After some exposure to this kind of stuff you don't even know what's real and what's level of corporate-sanctioned bullshit is above or below the baseline set by The Policy.
And don't forget the "SSO Tax" that some SaaS implement. Ideally, your company login should be your one and only login, and should be strongly tied to your device, a hardware token, and a central directory. Often, Saas providers charge far more to integrate with these directories, so, companies will just use a lower cost "LDAP Authentication" and condition users to enter their staff passwords on multiple sites :(
>"The session timeout here, kerberos prompt for smartcard here, the vpn hickup, teams needs to reconnect after the laptop gets out of sleep state. Then half of it random at some point updates and looks subtly different too."
OMG. Did not consider that. Lucky me. I do software development for clients, include some of decent size but am independent to the point that all my development is done at my own premises (basement of my house;) .
I use a similar filter at work but have it automatically label it as external and remove it from my primary inbox, not completely blocking but I have to go find emails from new people. I do filter external emails from vendors we do use into folders and read them. But the amount of spam I get just because someone managed to find my title and email is insane. I don’t even have my work email listed anywhere publicly that I am aware of.
There are many curriculums where IT security is taught in schools [0]. America does have a problem where their education systems are extremely disparate, but the lack is not universal.
[0] Virginia commonly uses Fortinet's lesson plans, for example.
You get a lot of stuff in the inbox that doesn't exactly relate to your day to day work from departments you only vaguely heard about.
Then the UX of corporate stuff, especially one from microsoft is designed in a way to randomly jump in your face with a password prompt without you starting it actively. The session timeout here, kerberos prompt for smartcard here, the vpn hickup, teams needs to reconnect after the laptop gets out of sleep state. Then half of it random at some point updates and looks subtly different too.
After some exposure to this kind of stuff you don't even know what's real and what's level of corporate-sanctioned bullshit is above or below the baseline set by The Policy.