Targeted Attack Email Countermeasure Training Customer Case Study
Ogura Co., Ltd.｜Targeted Attack Email Countermeasure Training Customer Case Study
- We have been using HENNGE’s services for about 10 years.
We selected Tadrill not only because of its features and services,
but also because of its trustworthiness and our expectations for the new service. -
- Reasons for adoption
- Fixed price system allows for constant and reasonable cost sharing, and training can be conducted without worrying about the number or frequency of training sessions.
- Effects of Introduction
- Fixed price system allows for constant and reasonable cost sharing, and training can be conducted without worrying about the number or frequency of training sessions.
About Ogura Co., Ltd.
- Business Overview
- Sales of alcoholic beverages for business use
- Thoughts
- Lemon Sour at the restaurant I went to that day I turned 20.
Draft beer at a place where I used to hang out with my buddies.
Wine from a restaurant I chose tall on a first date.
Champagne from the restaurant where he proposed
Highball at the restaurant where I bitch and moan with my colleagues.
Sake at the restaurant for a quiet moment alone.
Drinks at the restaurant are delicious.
We are the one who delivers “that one bottle” to the restaurants.
We are a liquor store.
(excerpt from Ogura’s website)
Regular email drills are conducted with Tadrill for about 250 employees in total
How is Tadrill being used?
How easy is Tadrill to use?
Tadrill has all the functions necessary to conduct e-mail training, from creating the text of training e-mails to distributing them and checking the results, and we have no complaints about its ease of use.
How do you create the text for training e-mails?
The templates are created by referring to Tadrill’s templates.The templates are very useful because they have a wide variety of genres and contents, and are updated regularly.
Ultimately, it is important to ensure that measures are taken by “people”
What is the purpose and background behind the e-mail training?
There have been many reports of damage caused by targeted attacks and ransomware, regardless of industry or size.We have a sense of crisis that if we were forced to suspend operations, it could cause inconvenience to our restaurant clients, and we conduct e-mail training as part of our security measures to protect our systems from e-mail attacks.
Do you have any other measures in addition to e-mail drills?
We have introduced Google Workspace, and Gmail’s filtering function has helped us to prevent spam to some extent, but spam emails that appear to be from major e-commerce sites or financial institutions sometimes slip through the spam filtering.Therefore, we believe that it is necessary to take thorough measures to prevent spam mails by “people,” i.e., not to open suspicious e-mails.
Has there been any damage or incidents caused by targeted attacks or ransomware in the vicinity of your company?
Before Tadrill’s service was released, we had conducted email drills with another service.We were not dissatisfied with the functionality or results of that service, but because it was an outsourcing type service where the entire training was outsourced, we had to pay a certain amount of money each time we conducted the training.In addition, we had to request the vendor to conduct a meeting each time, which was time-consuming and time-consuming.
Therefore, we can conduct training without worrying about the number or frequency of training sessions, with a fixed and reasonable cost burden.Tadrill is ideal for us because we can conduct training in-house, which allows us to be flexible and quick in our response.In addition, we have been using HENNGE One as our single sign-on authentication infrastructure for about 10 years, and we decided to implement the new service because we have a lot of trust in HENNGE and had high expectations for the new service.
Were there any other services you compared with Tadrill?
We checked other services, but found that they had limited functionality and lacked sufficient support, so we did not compare them in detail.
Was there anything you had to do to prepare for the introduction of Tadrill?
We had to change the Gmail settings, so we had to follow the instructions, but there was nothing else to prepare for.
In addition, prior to the start of the Tadrill email training, we sent out a tutorial to all employees, asking them to use the “Tadrill alert” add-on to report any emails they see.
The purpose was to let them know that we would be conducting email training on a regular basis, but it was also to make sure that all employees received the training email and to give them a new awareness of what to do when they receive a suspicious email.The training was intended to make employees aware that they should not click on links in suspicious e-mails and should contact the reporting desk immediately, and that if they open a suspicious e-mail or open an attached file, they should contact the desk immediately.
Increased “awareness” of suspicious e-mails
What are the results of the email training?
In the most recent training, the click rate on links in training e-mails was about 8%, and the report rate of those who contacted us about receiving suspicious e-mails was about 36%.
Regarding the click rate, while the number of training exercises has not yet been conducted very often, there is a tendency for the percentage to change depending on the content of the text.However, we feel that “awareness” of suspicious e-mails is improving. For example, we have heard that some executives and employees are quite nervous when they click on a link in a training e-mail, because a record of the click is kept.We do not want to see any response that would interfere with business operations, but from the standpoint of security, the fact that people are now responding to e-mails in such a careful manner is a certain result of the training.
Although the reporting rate has been steadily improving, there are still some employees who report by e-mail without using the Tadrill alert add-on.We would like to unify the reporting process and ensure the use of the reporting add-on (Tadrill alert) so that when we receive an email that requires a response, we can take prompt and appropriate action.
Do you provide follow-up services for employees who click on links in training e-mails?
Currently, we do not yet provide individual follow-up services, but we would like to take measures against employees whose reactions to the training e-mails do not change even after repeated training.
How have employees responded to the e-mail training?
Recently, the damage caused by targeted attacks and ransomware has been discussed in the news, and it seems that employees generally understand that we conduct e-mail training as a countermeasure.We have not found any negative reactions or opinions in the questionnaires we have received after the training.
HENNGE is easy to talk to, so it is easy to make requests and consultations
Please let us know if you have any requests or expectations for HENNGE.
HENNGE not only provides high quality services, but also is courteous and responds to e-mails immediately.After conducting the email training by Tadrill, they analyze the results and give us advice on how to respond in the future, which is very helpful.This has been very helpful.I look forward to even more user-friendly and useful features and services in the future.