4 ms·
This can be equalized by having a perk or bonus on reporting phishing attacks to IT. Anything from casual Friday (for offices that are not relaxed wear) to a
by wstuartcl 7y ago
This can be equalized by having a perk or bonus on reporting phishing attacks to IT. Anything from casual Friday (for offices that are not relaxed wear) to a Starbucks card or whatever. IMHO the act of timely reporting the click on a phishing email should negate the email click penalty. The idea is make the wanted behavior pleasurable and the unwanted ones painful.
- deleted 7y ago[deleted]
- LaGrange 7y ago> This can be equalized by having a perk or bonus on reporting phishing attacks to IT. ...there is no way you can equalise "you're going to lose your job" with anything less than "we're going to give you enough money that you won't really need the job anymore." And with a Starbucks card or casual Friday? I'm not even sure if you're being serious, because that sounds like a joke.
- wstuartcl 7y agoI was trying to make the case that you can give perks for natural reporting to IT (passive and active) + ensure that a user that has acted on a phishing email that reports it in a timely manor is treated as a non-fail (at least at some level). Both of these things together leave a system in place where: users are highly penalized for failing a phish test (or real life phishing attempts) User's that fail the test (or real phishing attempt), but follow it with a timely notice have less pain. Users that notify on apparent phishing attempts get small rewards. That does not seem like a joke to me.