4 ms·

...and now we see why such policies are bad, and it's even covered in the article: while people falling for phishing are bad, what's even worse is when they fal

...and now we see why such policies are bad, and it's even covered in the article: while people falling for phishing are bad, what's even worse is when they fall for it and don't report. Creating a culture where the security is the enemy is _not_ good. I mean, sure, if it's 20 times, we're getting into outrageous territory and you have reasons to suspect employee is trolling you. But other than that, the reality is that your employees _will_ get phished eventually. Reduce the risk and work on reducing the harm caused when it happens, instead of antagonising your workforce. Edit: also, if you could just "filter out" the test means that the tests were about as good as most corporate "compliance" training is. Just as the firings, it feels designed more to coddle the C-levels than actually achieve anything.

carlmr 7y ago
I also incidentally found an easy a filter for these. I found once that our proxy auto config has 10 misspelled domain names. Those are all used for the Phishing Tests.
wstuartcl 7y ago
This can be equalized by having a perk or bonus on reporting phishing attacks to IT. Anything from casual Friday (for offices that are not relaxed wear) to a Starbucks card or whatever. IMHO the act of timely reporting the click on a phishing email should negate the email click penalty. The idea is make the wanted behavior pleasurable and the unwanted ones painful.
- deleted 7y ago
  [deleted]
- LaGrange 7y ago
  > This can be equalized by having a perk or bonus on reporting phishing attacks to IT. ...there is no way you can equalise "you're going to lose your job" with anything less than "we're going to give you enough money that you won't really need the job anymore." And with a Starbucks card or casual Friday? I'm not even sure if you're being serious, because that sounds like a joke.
  - wstuartcl 7y ago
    I was trying to make the case that you can give perks for natural reporting to IT (passive and active) + ensure that a user that has acted on a phishing email that reports it in a timely manor is treated as a non-fail (at least at some level). Both of these things together leave a system in place where: users are highly penalized for failing a phish test (or real life phishing attempts) User's that fail the test (or real phishing attempt), but follow it with a timely notice have less pain. Users that notify on apparent phishing attempts get small rewards. That does not seem like a joke to me.

carlmr 7y ago

I also incidentally found an easy a filter for these. I found once that our proxy auto config has 10 misspelled domain names. Those are all used for the Phishing Tests.

wstuartcl 7y ago

This can be equalized by having a perk or bonus on reporting phishing attacks to IT. Anything from casual Friday (for offices that are not relaxed wear) to a Starbucks card or whatever. IMHO the act of timely reporting the click on a phishing email should negate the email click penalty. The idea is make the wanted behavior pleasurable and the unwanted ones painful.

deleted 7y ago
[deleted]
LaGrange 7y ago
> This can be equalized by having a perk or bonus on reporting phishing attacks to IT. ...there is no way you can equalise "you're going to lose your job" with anything less than "we're going to give you enough money that you won't really need the job anymore." And with a Starbucks card or casual Friday? I'm not even sure if you're being serious, because that sounds like a joke.
- wstuartcl 7y ago
  I was trying to make the case that you can give perks for natural reporting to IT (passive and active) + ensure that a user that has acted on a phishing email that reports it in a timely manor is treated as a non-fail (at least at some level). Both of these things together leave a system in place where: users are highly penalized for failing a phish test (or real life phishing attempts) User's that fail the test (or real phishing attempt), but follow it with a timely notice have less pain. Users that notify on apparent phishing attempts get small rewards. That does not seem like a joke to me.