3 ms·

The term "defense in depth" comes to mind. Of course, ideally the IT team has screened out the phishing attempt and secured systems as much as they can. If th

The term "defense in depth" comes to mind. Of course, ideally the IT team has screened out the phishing attempt and secured systems as much as they can. If they do it perfectly, then your comment applies and nothing else matters. If, however, the security team cannot be perfect, some amount of bad stuff will land with the users. This seems realistic. So training people to be security-minded is useful. It's the next line of defense. How do you train your users? "Just send an email and request that users report it to whoever is responsible" as you mention is one thing. But you can also imagine someone complying with that but then falling for a well crafted phish (that happened to me, as I mention elsewhere in this thread.) Being confronted with falling for something makes people take the threat more seriously. It takes someone's attitude from "it can't happen to me" to "oh, it did happen to me." >> at my company anything important is gated by a U2F token, among other things. We are simply 'immune' to most types of phishing I don't know your business' threats but that seems naïve. Imagine your sales team gets a phish email asking them to list your biggest customers, including contact info and revenue "so that we can send them an appropriate thank you gift for the holidays." If someone replies to this/fills out the form, you have leaked critical information even though nobody has penetrated your system (so your tokens don't help.) Even if this type of thing isn't a problem for your business, you can imagine it is for many.

staticassertion 6y ago
> The term "defense in depth" comes to mind. Perhaps my least favorite phrase in security, used constantly to justify weak, meaningless, or harmful work as "another layer". U2F is just one layer. It's a real, meaningful layer - it addresses real threats in a non-phishable way. Gating access by device, acls, etc, or locking down sharing permissions, are other real and meaningful layers. > some amount of bad stuff will land with the users That's the security team's problem to solve. > But you can also imagine someone complying with that but then falling for a well crafted phish (that happened to me, as I mention elsewhere in this thread.) I can just assume that one person will fail the phishing test already, and work from that angle. Way better than assuming I can teach an entire company to be untrickable. > Is there no data that humans can leak out by entering it in the wrong place? Wire transfers were one example - there are others, and we have other ways to mitigate those without assuming users should bear the responsibility. By 'most types' I mean either phishing for credentials or as a delivery mechanism for malware - these would both be extremely difficult to do, or otherwise mitigated by other policies. > but you can imagine that in many businesses there is. That's their security team's problem to solve. Feel free to train users, I have no problem with it. We do it for compliance purposes, but it's also a fun opportunity to engage with people about security, including meaningful security. And you do want people to be able to spot and report phishing, it's just not something you should ever rely on, or compromise for.
- xyzelement 6y ago
  I can't tell your thesis here. I agree you can't expect people to provide full defense, and it doesn't sound like you disagree that helping people act more securely is important. In my example, there's a difference between whether one sales person leaked their business numbers, or the entire 100 person department did. You train users to minimize the vulnerability even if you can't fully solve it. If you agree that far - then I am not sure where we're disconnecting on this question.
  - staticassertion 6y ago
    I would imagine we're disagreeing with the "at what cost"? As in, is the cost of: 1. Losing the trust of your coworkers 2. Causing public reputation damage 3. Potentially harming coworkers emotionally worth the gain of having a slightly more effective phishing training? I would argue no. I would also say that it isn't nearly as important as implementing other measures - U2F being a big one that I'd mentioned, but there are plenty of others. It's certainly not where I'd recommend anyone start.
- _jal 6y ago
  I can't tell, but it seems like you have unrealistic expectations for security teams. One the one hand, you handwave about how things are 'their problem', and on the other dismiss standard methods and models as baseless self-justification. I would turn down a position reporting to someone with this combination of attitudes - I'm pretty sure my hands would be tied, only there to take them blame when the inevitable happened.
  - staticassertion 6y ago
    I've worked on security teams or for security teams for my entire career. Yes, some things are the security team's problem - as in, security teams are responsible for managing risk. My expectation is for them to do so. Again, you can perform phishing tests, but I think they're mostly a waste of time, a terrible substitute for real mitigations, and should never come at the cost of your employee's sanity - a security team must build trust with other teams first and foremost, not burn it because "real attackers are mean too". > dismiss standard methods and models My opinions are hardly controversial.
runarberg 6y ago
> The term "defense in depth" comes to mind. For me the term that comes to mind is: Security at the cost of quality of life. Sometimes security is redundant, that is fine. Sometimes it is unessisary, that could be fine as long as it is not harmful. Phishing training should be redundant at worst and unessisary at best. But these types of phishing training definitely has negative effects on the trainees. You are invoking a sense of failure and unessisary stress. Some people will have underlying stress issues, perhaps they are having a bad day, perhaps they are experiencing PTSD, and then seeing they failed a phishing test could be disastrous. Definitely not worth putting your workers at this risk for supposed (and unproven) security.

staticassertion 6y ago

> The term "defense in depth" comes to mind. Perhaps my least favorite phrase in security, used constantly to justify weak, meaningless, or harmful work as "another layer". U2F is just one layer. It's a real, meaningful layer - it addresses real threats in a non-phishable way. Gating access by device, acls, etc, or locking down sharing permissions, are other real and meaningful layers. > some amount of bad stuff will land with the users That's the security team's problem to solve. > But you can also imagine someone complying with that but then falling for a well crafted phish (that happened to me, as I mention elsewhere in this thread.) I can just assume that one person will fail the phishing test already, and work from that angle. Way better than assuming I can teach an entire company to be untrickable. > Is there no data that humans can leak out by entering it in the wrong place? Wire transfers were one example - there are others, and we have other ways to mitigate those without assuming users should bear the responsibility. By 'most types' I mean either phishing for credentials or as a delivery mechanism for malware - these would both be extremely difficult to do, or otherwise mitigated by other policies. > but you can imagine that in many businesses there is. That's their security team's problem to solve. Feel free to train users, I have no problem with it. We do it for compliance purposes, but it's also a fun opportunity to engage with people about security, including meaningful security. And you do want people to be able to spot and report phishing, it's just not something you should ever rely on, or compromise for.

xyzelement 6y ago
I can't tell your thesis here. I agree you can't expect people to provide full defense, and it doesn't sound like you disagree that helping people act more securely is important. In my example, there's a difference between whether one sales person leaked their business numbers, or the entire 100 person department did. You train users to minimize the vulnerability even if you can't fully solve it. If you agree that far - then I am not sure where we're disconnecting on this question.
- staticassertion 6y ago
  I would imagine we're disagreeing with the "at what cost"? As in, is the cost of: 1. Losing the trust of your coworkers 2. Causing public reputation damage 3. Potentially harming coworkers emotionally worth the gain of having a slightly more effective phishing training? I would argue no. I would also say that it isn't nearly as important as implementing other measures - U2F being a big one that I'd mentioned, but there are plenty of others. It's certainly not where I'd recommend anyone start.
_jal 6y ago
I can't tell, but it seems like you have unrealistic expectations for security teams. One the one hand, you handwave about how things are 'their problem', and on the other dismiss standard methods and models as baseless self-justification. I would turn down a position reporting to someone with this combination of attitudes - I'm pretty sure my hands would be tied, only there to take them blame when the inevitable happened.
- staticassertion 6y ago
  I've worked on security teams or for security teams for my entire career. Yes, some things are the security team's problem - as in, security teams are responsible for managing risk. My expectation is for them to do so. Again, you can perform phishing tests, but I think they're mostly a waste of time, a terrible substitute for real mitigations, and should never come at the cost of your employee's sanity - a security team must build trust with other teams first and foremost, not burn it because "real attackers are mean too". > dismiss standard methods and models My opinions are hardly controversial.

runarberg 6y ago

> The term "defense in depth" comes to mind. For me the term that comes to mind is: Security at the cost of quality of life. Sometimes security is redundant, that is fine. Sometimes it is unessisary, that could be fine as long as it is not harmful. Phishing training should be redundant at worst and unessisary at best. But these types of phishing training definitely has negative effects on the trainees. You are invoking a sense of failure and unessisary stress. Some people will have underlying stress issues, perhaps they are having a bad day, perhaps they are experiencing PTSD, and then seeing they failed a phishing test could be disastrous. Definitely not worth putting your workers at this risk for supposed (and unproven) security.