Rate this another idea : "SaaS to train people against phishing attacks"

[Prantice]

Hello everyone, I submitted a previous idea which was "P2P app to sell your food leftovers" . I realized quickly that not only the idea was stupid but also dangerous in terms of food regulation. And regarding the problem I tried to solved ? Fortunately, there are already charities and entities working on this problem. So, I decided to work on an another big problem of our world : Cybersecurity attacks against companies and peoples.

Let's imagine you are in the company Y. you are doing your work as usual and suddenly, you receive what seems to be an important email. This email seems to come from a supplier. He sent you an invoice in the excel format.
You download the file, you launch it and you allow the file to launch its macro (After all, the file kindly asked you to do it) and Congratulations ! You've just been cat fished by a hacker. Now wait for several hours and the company network will be hacked by a ransomware or another nasty malware. In best case scenario, the company will deploy a backup and just suffer financial loss. Worst cases scenarios, the company will be out of business within the next months (In France, 60% of the companies hacked are filling for bankruptcy) . Remember that this chain of event can happen because of a single malicious email. But what happened if instead of launching the file, you report the email because you saw something odd in it ? My goal here is to help people to defend themselves against phishing attacks by training them.

My idea is to create an online software (SaaS) on which you can register, give some information on your companies (Such as your employees email address for example). And voilà ! the software will simulate phishing attacks against your employees. If the employee report the email, he will be redirected on a landing page which congratulates him for detecting the malicious email. If instead, he clicked on the malicious link or file, he will be redirected to another landing which will warn him that he was cat fished. He will have then, the possibility to read guides teaching him how to detect phishing attacks, what to do and more... Of course, nothing is compromised during the campaign and the information submitted by the employees aren't saved anywhere.

Before writhing this thread, I ran my idea through the [CENTS](https://www.thefastlaneforum.com/community/threads/the-cents-business-commandments-for-entrepreneurs.81090/ "CENTS") framework and asked myself common-sense questions to see if this idea is good, here's what I found :

C for Control : It will be a SaaS hosted on a personal website. Even though I will create my own software and company, I will be dependent on web hosting companies to host my software once it will be finished. To lessen this dependence, I can hire several web hosting companies to balance the load of my website and avoid any disruption of my service in case of technical failures from one of the web hosting company.

E for Entry : You need to know how to create a website (HTML, CSS, PHP, MySQL at least) to build a website... Also, you need to have experience in the cybersecurity field (What is a phishing attack, what are the different attack vectors...). So yeah, the entry barrier is high, very high for this one. This is not a problem since I have an engineering degree in cybersecurity, have no problem to learn new computer skills and last but not least, a 3 years work experience within the cybersecurity field...

N for Need : In France and from my experience, phishing is by far, the most used attack to gain a foothold within a company network in the context of a cybersecurity attack. Also, less than 1 company on 2 invest money into their cybersecurity. So, this is a very big problem which needs to be faced immediately.

T for Time : I will need a lot of time to design, develop and test the app but once the first version of the software is functional, I will just have to "convince" companies to use it. My goal will be to create a system of subscription in which, people will have the possibility to pay monthly or annually. I'm still figuring out how the subscription will work but I know for sure that it will be easy to detach the revenue generated from my time with this software.

S for Scale : Once the software will be functional, it will be very easy for people to create their own account, configure it and simulate phishing attacks on their company. The only thing I need to watch out for is the number of servers which will host the software. Despite this, there will be no problem to scale this software to a greater market. If I want to

In addition to this framework, here's is a non-exhaustive list of benefits of my idea which might be translated into value-skews (if executed upon) :

• Hosted in France : Since we are speaking about a cybersecurity SaaS, the fact that the software is hosted in France may have a huge impact on the CEO of french companies. Why you may ask yourselves ? Simply because of the CLOUD act in the USA. the idea that any foreign governmental entity may have access to confidential data regarding the security of french companies (If they use a software relying on an foreign datacenter or company to keep it very simple) is eerie to us, french people. So, this might play in my favor to differentiate myself from the competitors.
• Train company employee to detect phishing attacks : By using this software, you train your employees to detect phishing attacks. Thus, you lessen your probabilities to find one day that your company was hacked because someone opened a malicious email.
• Get tailored phishing campaigns for your company : Because every company is different, my goal here is to deploy a system in which the phishing campaigns will be "smart". By smart I mean that based on the attack which worked (The employee which submit their login through a malicious page) and didn't worked, the software will detect that and train the employee on their weakness (AI, Machine learning ? I need to figure it out for this one) .
• Anonymization of the targeted employees : Training people against cybersecurity attack is a good thing. However, when the performance of the employee are measured on a real-time dashboard with their name and picture, this might be a huge problem for union workers. Hence, The CEO will not see the stat of each employee but instead, the statistics for each department (For example, 20% of the phishing emails sent to the IT department were opened whereas 80% of phishing mails sent to the HR department where opened...). Without knowing the name of employees who opened the email, the CEO will know which department needs more cybersecurity training.
• Realistic but dummy attacks : During the "fake" phishing attack, the information submitted aren't saved or sent somewhere and the "files" launched by the employees will just send a message to the SaaS that somebody opened a file and that's it. The only information saved within the software will only be for statistical purposes, to count for example the number of employees who opened the dummy file or opened the dummy link within the phishing email, SMS...

To conclude, I think this is a much better idea than the previous one I had. So, what do you think, let's say that the software I described earlier is fully functional, will you be using it to train your employees ? If not, why ? I am also trying to see here if people are interested in this type of software for their own companies. I think this idea might be the winning one from all the one I had so far but once again, I'm writing to this post just to confirm my intuition. Don't hesitate to challenge if you think something is off within my post.

Thank you again for your time and I wish you a nice day.

Prantice

Sources (Only in French, sorry.):
1) Cybersécurité : 60% des PME attaquées déposent le bilan
2) Cybersécurité en France, 10 statistiques clés à connaître en 2022 ! - Ndnm

 

Dislike ads? Remove them and support the forum: Subscribe to Fastlane Insiders.

[Tau Ceti]

I think this idea is good but if I were you I would think twice before building it now.

Try getting a few companies interested in the concept, then do all the work manually in the background(sending the emails, generate the reports and so on and so forth)

Once you have done it with one company, use their case study to land other companies. Once you have done it with 4 or 5 different companies, then you ll know exactly what to build otherwise you risk building something that the market may not want nor need.

the solution you propose is very complex and contains a lot of unknown unknowns which means that it will take you 6 to 8 months to build it because you have a full time job which is going to consume most of your time.

The goal of having the SAAS do the work is great but premature here I believe. Just my 2 cts.

A few questions to consider:
- are you legally liable for impersonating someone else?
- what if the servers you use to send spam get blacklisted? Which company is going to allow you to send fake spam mails/phishing mails? AKAIK it's against the TOS of most email sending companies.
- Is this really a monthly purchase for those companies that you target? I see this service more as a one off once a year or something that someone would do before being acquired or raising money.
- If you need to collect all employees email addresses, then you become the target of phishing. Who is guarding the guards and all that jazz?

 

[Tau Ceti]

It will be a SaaS hosted on a personal website. Even though I will create my own software and company, I will be dependent on web hosting companies to host my software once it will be finished.

How else would you host it? What is a personal website in this case?

I will just have to "convince" companies to use it.

You should probably do that first before building it.

The only thing I need to watch out for is the number of servers which will host the software

You are putting the cart before the horse here. You can worry about scaling when you get 10 paying companies, although if all you do is send email and count the number of links clicked then you can hots this website on a $5 a month VPS.

 

[Tau Ceti]

Because every company is different, my goal here is to deploy a system in which the phishing campaigns will be "smart". By smart I mean that based on the attack which worked (The employee which submit their login through a malicious page) and didn't worked, the software will detect that and train the employee on their weakness (AI, Machine learning ? I need to figure it out for this one) .

Too premature. Save those features for later. Just get 1 customer first.

Training people against cybersecurity attack is a good thing. However, when the performance of the employee are measured on a real-time dashboard with their name and picture, this might be a huge problem for union workers. Hence, The CEO will not see the stat of each employee but instead, the statistics for each department (For example, 20% of the phishing emails sent to the IT department were opened whereas 80% of phishing mails sent to the HR department where opened...). Without knowing the name of employees who opened the email, the CEO will know which department needs more cybersecurity training.

Yeah again, that's too premature. See what the market demands then you can talk to a lawyer or someone to figure this stuff out.

 

Dislike ads? Remove them and support the forum: Subscribe to Fastlane Insiders.

[Bence Ur]

I think it's already resolved.

You can use Linux, with proper user permissions you don't even need a firewall and anti-virus. It is not an issue on Linux.

In case of Windows there are already a lot of anti-virus programs which solve this very problem.

In case of phishing when the attackers are trying to steal your password, the solution is simple: always use a password manager like Bitwarden, 1Password etc. If the site is a phishing site then the password manager won't fill in the password, very simple. And you can't fill in the password manually since you don't know the password, it is stored in the password manager in encrypted format. So in this case phishing doesn't work.

Also Google Chrome and other browsers block these malicious sites by default. Gmail and other email providers block the malicious files server-side.

Cybersecurity is a huge market, but phishing is the simplest attack.

 

[LateStarter]

KnowBe4 does this. Training, simulated attacks and reporting and iterative training for staff based on those results. I'm sure there's room for competition, but it already exists.

Security Awareness Training | KnowBe4

KnowBe4 provides Security Awareness Training to help you manage the IT security problems of social engineering, spear phishing and ransomware attacks.

www.knowbe4.com

 

[RudyR]

So this is called, Phishing awareness training. Here are the top 3 google search results:

Microsoft has an Attack simulation training:

Phishing Attack Simulation Training | Microsoft Security

Prevent phishing attacks and provide attack simulation training. Automate simulation creation, payload attachment, user targeting, schedule, and cleanup.

www.microsoft.com

Rapid7

Phishing Awareness Training: Simulating Phishing Attacks

Help employees recognize and report phishing attempts by building a robust phishing awareness training program at your organization. Here's how to get started.

www.rapid7.com

CrowdStrike:

How To Implement Phishing Attack Awareness Training

Phishing attempts are reaching new heights. It’s important for all employees to be able to identify them & play an active role to keep your business & customers safe.

www.crowdstrike.com

Phishing is just one of many niches in the realm of Cyber Security.

Once you know your competition, you can figure out your value skew.

 

Dislike ads? Remove them and support the forum: Subscribe to Fastlane Insiders.

[RicardoGrande]

So this is called, Phishing awareness training. Here are the top 3 google search results:

Microsoft has an Attack simulation training:

Phishing Attack Simulation Training | Microsoft Security

Prevent phishing attacks and provide attack simulation training. Automate simulation creation, payload attachment, user targeting, schedule, and cleanup.

www.microsoft.com

Rapid7

Phishing Awareness Training: Simulating Phishing Attacks

Help employees recognize and report phishing attempts by building a robust phishing awareness training program at your organization. Here's how to get started.

www.rapid7.com

CrowdStrike:

How To Implement Phishing Attack Awareness Training

Phishing attempts are reaching new heights. It’s important for all employees to be able to identify them & play an active role to keep your business & customers safe.

www.crowdstrike.com

Phishing is just one of many niches in the realm of Cyber Security.

Once you know your competition, you can figure out your value skew.

Came here to post this, I have salesmen reaching out to me at least 1-2x a month selling security trainings and phishing simulation. Microsoft already offers it with basic office licensing now and it'd be hard to beat them considering security training is usually begrudgingly allowed and seldom done unless it's a DoD or a select few gov agencies on the microsoft govcloud.

Alternatively, you could offer one-time phishing audits, even though MS and other services can allow admins to schedule, a lot of managers get hard d!cks thinking about something they could do that makes it look like they're on the ball and doing something important or to stay in compliance. Your potential payout would be much higher as well.

 

[Snowball]

KnowBe4 does this. Training, simulated attacks and reporting and iterative training for staff based on those results. I'm sure there's room for competition, but it already exists.

Security Awareness Training | KnowBe4

KnowBe4 provides Security Awareness Training to help you manage the IT security problems of social engineering, spear phishing and ransomware attacks.

www.knowbe4.com

Off topic, but KnowBe4 is such an odd business name, so many possible spellings.

KnowBefore, KnowBeFour, NoBe4, NoB4, NoBefore, KnowB4, etc.

Another reason not to overthink things like naming a business though, at least when starting out

 

[ZackerySprague]

 

Dislike ads? Remove them and support the forum: Subscribe to Fastlane Insiders.

[Prantice]

Thank you everyone for your input !

I think this idea is good but if I were you I would think twice before building it now.

Try getting a few companies interested in the concept, then do all the work manually in the background(sending the emails, generate the reports and so on and so forth)

Once you have done it with one company, use their case study to land other companies. Once you have done it with 4 or 5 different companies, then you ll know exactly what to build otherwise you risk building something that the market may not want nor need.

the solution you propose is very complex and contains a lot of unknown unknowns which means that it will take you 6 to 8 months to build it because you have a full time job which is going to consume most of your time.

The goal of having the SAAS do the work is great but premature here I believe. Just my 2 cts.

A few questions to consider:
- are you legally liable for impersonating someone else?
- what if the servers you use to send spam get blacklisted? Which company is going to allow you to send fake spam mails/phishing mails? AKAIK it's against the TOS of most email sending companies.
- Is this really a monthly purchase for those companies that you target? I see this service more as a one off once a year or something that someone would do before being acquired or raising money.
- If you need to collect all employees email addresses, then you become the target of phishing. Who is guarding the guards and all that jazz?

Regarding the technical questions, I have already done a similar project when I was in my former engineering school so, even though I don't know the exact answers to these type of questions, I know that I can find quickly the answer to them. However, within the legal domain, I fear that the answer are far from being obvious (regarding my opinions and knowledge on this field).

How else would you host it? What is a personal website in this case?

You should probably do that first before building it.


You are putting the cart before the horse here. You can worry about scaling when you get 10 paying companies, although if all you do is send email and count the number of links clicked then you can hots this website on a $5 a month VPS.

Sorry I mislead you with the term "Personal website" (I will correct this in my first post), what I was thinking is that the SaaS will be host on a server which will be rented from a web hosting and that the website will be created from scratch.

Too premature. Save those features for later. Just get 1 customer first.



Yeah again, that's too premature. See what the market demands then you can talk to a lawyer or someone to figure this stuff out.

You are right here, I should go outside and ask CEO what are their needs regarding the cybersecurity field.

I think it's already resolved.

You can use Linux, with proper user permissions you don't even need a firewall and anti-virus. It is not an issue on Linux.

In case of Windows there are already a lot of anti-virus programs which solve this very problem.

In case of phishing when the attackers are trying to steal your password, the solution is simple: always use a password manager like Bitwarden, 1Password etc. If the site is a phishing site then the password manager won't fill in the password, very simple. And you can't fill in the password manually since you don't know the password, it is stored in the password manager in encrypted format. So in this case phishing doesn't work.

Also Google Chrome and other browsers block these malicious sites by default. Gmail and other email providers block the malicious files server-side.

Cybersecurity is a huge market, but phishing is the simplest attack.

Even though I have already heard about Bitwarden, 1Password (I'm using KeePass), I didn't know that you don't have the possibility to "see" your stored password.

KnowBe4 does this. Training, simulated attacks and reporting and iterative training for staff based on those results. I'm sure there's room for competition, but it already exists.

Security Awareness Training | KnowBe4

KnowBe4 provides Security Awareness Training to help you manage the IT security problems of social engineering, spear phishing and ransomware attacks.

www.knowbe4.com

So this is called, Phishing awareness training. Here are the top 3 google search results:

Microsoft has an Attack simulation training:

Phishing Attack Simulation Training | Microsoft Security

Prevent phishing attacks and provide attack simulation training. Automate simulation creation, payload attachment, user targeting, schedule, and cleanup.

www.microsoft.com

Rapid7

Phishing Awareness Training: Simulating Phishing Attacks

Help employees recognize and report phishing attempts by building a robust phishing awareness training program at your organization. Here's how to get started.

www.rapid7.com

CrowdStrike:

How To Implement Phishing Attack Awareness Training

Phishing attempts are reaching new heights. It’s important for all employees to be able to identify them & play an active role to keep your business & customers safe.

www.crowdstrike.com

Phishing is just one of many niches in the realm of Cyber Security.

Once you know your competition, you can figure out your value skew.

Thanks for your inputs, regarding this idea, I have done some quick research regarding my competitors in France but I didn't have a clue about these companies.

Came here to post this, I have salesmen reaching out to me at least 1-2x a month selling security trainings and phishing simulation. Microsoft already offers it with basic office licensing now and it'd be hard to beat them considering security training is usually begrudgingly allowed and seldom done unless it's a DoD or a select few gov agencies on the microsoft govcloud.

Alternatively, you could offer one-time phishing audits, even though MS and other services can allow admins to schedule, a lot of managers get hard d!cks thinking about something they could do that makes it look like they're on the ball and doing something important or to stay in compliance. Your potential payout would be much higher as well.

I didn't know that Microsoft was already offering this type of training within their basic office offer. I'll write down your idea of offering one-time phishing audits as a service, this is a good idea.

View attachment 51341

Thanks for the screenshot (And its valuable information), I think it is an interesting idea to offer a one-time audit in which you help individuals (or corporations also ?) to see what information we have access to on them.

Once again, thank you for inputs, It helped me to figure out what kind of need I can fulfill. I will stop to create threads about my ideas. Your guys are right, I need to stop searching on my own and go outside to ask people (Preferably, CEO) the needs they have and about the ideas you all gave me in this thread.