5 ms·

There are companies providing fake phishing messages as a service. Use those and attach penalties for repeat idiots. If they don't care about putting the compan

There are companies providing fake phishing messages as a service. Use those and attach penalties for repeat idiots. If they don't care about putting the company at risk, they might at least think about putting their own employment at risk. Edit following the comments: maybe reversing the approach would work, by attaching monetary rewards to correctly reporting phishing emails? That would encourage everyone to be extra suspicious and report anything that looks amiss for the chance of getting some extra cash while avoiding the negatives of firing people on sight.

acdha 5y ago
That’s a good way to ensure everyone hates ITSec for punishing them despite having failed to provide an environment which is secure enough to survive someone clicking on a link in an email. That makes it less likely that people will report suspicious activity and gives a successful attacker a way to blackmail someone. This time is much better spent securing the environment: spend the money on Yubikeys, lock down your default browser or use an isolation system, beef up your network filtering, etc. — things which can actually work and won’t make your users think you’re just trying to get them fired.
- Nextgrid 5y ago
  The problem I see with locking things down is that you can't lock down things that the user requires for their job. If the user legitimately needs access to some sensitive information for example, it's just a matter of time before they can be tricked by an attacker into doing something stupid with it. Yubikeys would solve the problem of the user giving away their credentials to the sensitive data but wouldn't stop the user directly giving away said sensitive data. Locking down is also a blacklist approach where you can miss something and it will be exploited when an attacker eventually gets lucky. I'd rather be the one getting lucky and catching those users early than waiting for an attacker to catch them. I guess instead of a penalty a more user-friendly way would be to attach monetary rewards to reporting phishing emails? That would incentivize reporting anything that looks even just slightly suspicious, which is probably a better outcome from a security point of view even with false positives.
_jal 5y ago
You really don't want to do that. We use one of those services, too, and you have to use a very light touch. Just using them at all makes people paranoid. If there are people you find who pose a risk, yes, you should do something about that, but terrorizing your workforce is a terrible idea for multiple reasons. > putting their own employment at risk Even looking at it amorally, that only really works in declining industries where people don't have a choice. Do that to engineers in a hot economy, and I suspect you'll be employing only the otherwise-unemployable soon.
- imroot 5y ago
  About two years ago, where I worked really amplified up their phisting testing, and after the first batch when SO MANY PEOPLE failed (I heard the number was around 60%), they pushed out a new HR policy that included a suspension/termination for repeated offenders. Less than 3 months later, HR was begging people to click the link in their email to set up their benefits for the year, because they had a 0% click-through rate.
  - RF_Savage 5y ago
    Now thats some successful anti-phishing training.
  - ReactiveJelly 5y ago
    Perfect! Hang up, look up, call back.
munk-a 5y ago
Depending on the size and culture of the company I feel like that's a pretty risky proposition unless you've got senior leadership really chomping at the bit right after a major incident. It's quite likely someone pretty high up in the company will fall for the fake phishing and then you've got a bunch of politics in your lap.
octodog 5y ago
This happens at my work but if you click on a link you need to do a phishing awareness training module. I think this is an effective approach because it doesn't seek to punish anyone but instead train them to be more aware.

acdha 5y ago

That’s a good way to ensure everyone hates ITSec for punishing them despite having failed to provide an environment which is secure enough to survive someone clicking on a link in an email. That makes it less likely that people will report suspicious activity and gives a successful attacker a way to blackmail someone. This time is much better spent securing the environment: spend the money on Yubikeys, lock down your default browser or use an isolation system, beef up your network filtering, etc. — things which can actually work and won’t make your users think you’re just trying to get them fired.

Nextgrid 5y ago
The problem I see with locking things down is that you can't lock down things that the user requires for their job. If the user legitimately needs access to some sensitive information for example, it's just a matter of time before they can be tricked by an attacker into doing something stupid with it. Yubikeys would solve the problem of the user giving away their credentials to the sensitive data but wouldn't stop the user directly giving away said sensitive data. Locking down is also a blacklist approach where you can miss something and it will be exploited when an attacker eventually gets lucky. I'd rather be the one getting lucky and catching those users early than waiting for an attacker to catch them. I guess instead of a penalty a more user-friendly way would be to attach monetary rewards to reporting phishing emails? That would incentivize reporting anything that looks even just slightly suspicious, which is probably a better outcome from a security point of view even with false positives.

_jal 5y ago

You really don't want to do that. We use one of those services, too, and you have to use a very light touch. Just using them at all makes people paranoid. If there are people you find who pose a risk, yes, you should do something about that, but terrorizing your workforce is a terrible idea for multiple reasons. > putting their own employment at risk Even looking at it amorally, that only really works in declining industries where people don't have a choice. Do that to engineers in a hot economy, and I suspect you'll be employing only the otherwise-unemployable soon.

imroot 5y ago
About two years ago, where I worked really amplified up their phisting testing, and after the first batch when SO MANY PEOPLE failed (I heard the number was around 60%), they pushed out a new HR policy that included a suspension/termination for repeated offenders. Less than 3 months later, HR was begging people to click the link in their email to set up their benefits for the year, because they had a 0% click-through rate.
- RF_Savage 5y ago
  Now thats some successful anti-phishing training.
- ReactiveJelly 5y ago
  Perfect! Hang up, look up, call back.

munk-a 5y ago

Depending on the size and culture of the company I feel like that's a pretty risky proposition unless you've got senior leadership really chomping at the bit right after a major incident. It's quite likely someone pretty high up in the company will fall for the fake phishing and then you've got a bunch of politics in your lap.

octodog 5y ago

This happens at my work but if you click on a link you need to do a phishing awareness training module. I think this is an effective approach because it doesn't seek to punish anyone but instead train them to be more aware.