4 ms·

> The term "defense in depth" comes to mind. Perhaps my least favorite phrase in security, used constantly to justify weak, meaningless, or harmful work as "an

> The term "defense in depth" comes to mind. Perhaps my least favorite phrase in security, used constantly to justify weak, meaningless, or harmful work as "another layer". U2F is just one layer. It's a real, meaningful layer - it addresses real threats in a non-phishable way. Gating access by device, acls, etc, or locking down sharing permissions, are other real and meaningful layers. > some amount of bad stuff will land with the users That's the security team's problem to solve. > But you can also imagine someone complying with that but then falling for a well crafted phish (that happened to me, as I mention elsewhere in this thread.) I can just assume that one person will fail the phishing test already, and work from that angle. Way better than assuming I can teach an entire company to be untrickable. > Is there no data that humans can leak out by entering it in the wrong place? Wire transfers were one example - there are others, and we have other ways to mitigate those without assuming users should bear the responsibility. By 'most types' I mean either phishing for credentials or as a delivery mechanism for malware - these would both be extremely difficult to do, or otherwise mitigated by other policies. > but you can imagine that in many businesses there is. That's their security team's problem to solve. Feel free to train users, I have no problem with it. We do it for compliance purposes, but it's also a fun opportunity to engage with people about security, including meaningful security. And you do want people to be able to spot and report phishing, it's just not something you should ever rely on, or compromise for.

xyzelement 6y ago
I can't tell your thesis here. I agree you can't expect people to provide full defense, and it doesn't sound like you disagree that helping people act more securely is important. In my example, there's a difference between whether one sales person leaked their business numbers, or the entire 100 person department did. You train users to minimize the vulnerability even if you can't fully solve it. If you agree that far - then I am not sure where we're disconnecting on this question.
- staticassertion 6y ago
  I would imagine we're disagreeing with the "at what cost"? As in, is the cost of: 1. Losing the trust of your coworkers 2. Causing public reputation damage 3. Potentially harming coworkers emotionally worth the gain of having a slightly more effective phishing training? I would argue no. I would also say that it isn't nearly as important as implementing other measures - U2F being a big one that I'd mentioned, but there are plenty of others. It's certainly not where I'd recommend anyone start.
_jal 6y ago
I can't tell, but it seems like you have unrealistic expectations for security teams. One the one hand, you handwave about how things are 'their problem', and on the other dismiss standard methods and models as baseless self-justification. I would turn down a position reporting to someone with this combination of attitudes - I'm pretty sure my hands would be tied, only there to take them blame when the inevitable happened.
- staticassertion 6y ago
  I've worked on security teams or for security teams for my entire career. Yes, some things are the security team's problem - as in, security teams are responsible for managing risk. My expectation is for them to do so. Again, you can perform phishing tests, but I think they're mostly a waste of time, a terrible substitute for real mitigations, and should never come at the cost of your employee's sanity - a security team must build trust with other teams first and foremost, not burn it because "real attackers are mean too". > dismiss standard methods and models My opinions are hardly controversial.
  - _jal 6y ago
    > a security team must build trust I do agree with this part.
- runarberg 6y ago
  > dismiss standard methods and models as baseless self-justification I would argue that live training with a “set up for failure” is non-standard. A standard training has the trainee knowing they are in a training situation. I have never seen this type of training used for any situation other then phishing training. And before you say “fake firedrill”, no I have never seen those outside of the movies, and I would believe a Simpsons type situation where you are actively putting workers at risk is the reason for that.
runarberg 6y ago
Note also that fake phishing emails is not the only way to train people against phishing. Arguable traditional training (i.e. explain and show the trainee examples in a setting where the trainee knows this is a demo) is both a better way to teach about the risk and protection, and is less harmful. I used to work as a life guard and we would conduct training scenario every month at least. And we would never do live training (i.e. training scenario without knowing it is training). There are several reasons, first is safety. You would be putting workers in an unessisary risk. Second is stress, and third is that there is little evidence that we would walk away from the training having learned anything. So if you believe phishing is a serious threat to your security, that is still no excuse to deliver fake phishing emails to your workers.

xyzelement 6y ago

I can't tell your thesis here. I agree you can't expect people to provide full defense, and it doesn't sound like you disagree that helping people act more securely is important. In my example, there's a difference between whether one sales person leaked their business numbers, or the entire 100 person department did. You train users to minimize the vulnerability even if you can't fully solve it. If you agree that far - then I am not sure where we're disconnecting on this question.

staticassertion 6y ago
I would imagine we're disagreeing with the "at what cost"? As in, is the cost of: 1. Losing the trust of your coworkers 2. Causing public reputation damage 3. Potentially harming coworkers emotionally worth the gain of having a slightly more effective phishing training? I would argue no. I would also say that it isn't nearly as important as implementing other measures - U2F being a big one that I'd mentioned, but there are plenty of others. It's certainly not where I'd recommend anyone start.

_jal 6y ago

I can't tell, but it seems like you have unrealistic expectations for security teams. One the one hand, you handwave about how things are 'their problem', and on the other dismiss standard methods and models as baseless self-justification. I would turn down a position reporting to someone with this combination of attitudes - I'm pretty sure my hands would be tied, only there to take them blame when the inevitable happened.

staticassertion 6y ago
I've worked on security teams or for security teams for my entire career. Yes, some things are the security team's problem - as in, security teams are responsible for managing risk. My expectation is for them to do so. Again, you can perform phishing tests, but I think they're mostly a waste of time, a terrible substitute for real mitigations, and should never come at the cost of your employee's sanity - a security team must build trust with other teams first and foremost, not burn it because "real attackers are mean too". > dismiss standard methods and models My opinions are hardly controversial.
- _jal 6y ago
  > a security team must build trust I do agree with this part.
runarberg 6y ago
> dismiss standard methods and models as baseless self-justification I would argue that live training with a “set up for failure” is non-standard. A standard training has the trainee knowing they are in a training situation. I have never seen this type of training used for any situation other then phishing training. And before you say “fake firedrill”, no I have never seen those outside of the movies, and I would believe a Simpsons type situation where you are actively putting workers at risk is the reason for that.

runarberg 6y ago

Note also that fake phishing emails is not the only way to train people against phishing. Arguable traditional training (i.e. explain and show the trainee examples in a setting where the trainee knows this is a demo) is both a better way to teach about the risk and protection, and is less harmful. I used to work as a life guard and we would conduct training scenario every month at least. And we would never do live training (i.e. training scenario without knowing it is training). There are several reasons, first is safety. You would be putting workers in an unessisary risk. Second is stress, and third is that there is little evidence that we would walk away from the training having learned anything. So if you believe phishing is a serious threat to your security, that is still no excuse to deliver fake phishing emails to your workers.