3 ms·

> [H]aving a paranoid but blame-free culture is critical for security. The three employees who fell for the phishing scam were not reprimanded. We’re all human

> [H]aving a paranoid but blame-free culture is critical for security. The three employees who fell for the phishing scam were not reprimanded. We’re all human and we make mistakes. It’s critically important that when we do, we report them and don’t cover them up. That sounds to me like a very healthy culture. I wonder how many other organizations are similar?

Simon_O_Rourke 4y ago
I'd agree with that, we all make mistakes, and I could see myself groggily waking up to some text message like that and clicking through it before my full critical faculties have come online. The folks who clicked through thought they were doing what they should. As regards reprimands - it does sound like a healthy culture, and I've seen and worked in thoroughly rotten environments with an equally rotten security culture. One example that sticks out, I worked in a utility company where IT would install a laptop desk lock and tie it to your desk. Then security would come by at night a few weeks later, lift the desk and remove the lock and laptop. The kicker was then they would issue a reprimand to the person who owned the laptop for failing to secure it. This was pure security theatre so people could justify their role.
lrem 4y ago
That's what Google has been heralding since Google became newsworthy, so I'd imagine a lot of orgs picked that up.
_8j50 4y ago
Very few in my experience. I worked in a team where I regularly heard of talk to fire people for failing phishing tests.
dsr_ 4y ago
All the ones that actually care about security do this. If you want people to fix their mistakes and change, you need to encourage them to do so. If you want people to try to hide their mistakes, punish them. (If you discover that IT has permanently reserved a backup laptop for a particular employee who is perpetually in need of a fresh image, it's time to talk to their manager about why they fall for these things and what other mistakes they might be making.)

Simon_O_Rourke 4y ago

I'd agree with that, we all make mistakes, and I could see myself groggily waking up to some text message like that and clicking through it before my full critical faculties have come online. The folks who clicked through thought they were doing what they should. As regards reprimands - it does sound like a healthy culture, and I've seen and worked in thoroughly rotten environments with an equally rotten security culture. One example that sticks out, I worked in a utility company where IT would install a laptop desk lock and tie it to your desk. Then security would come by at night a few weeks later, lift the desk and remove the lock and laptop. The kicker was then they would issue a reprimand to the person who owned the laptop for failing to secure it. This was pure security theatre so people could justify their role.

lrem 4y ago

That's what Google has been heralding since Google became newsworthy, so I'd imagine a lot of orgs picked that up.

_8j50 4y ago

Very few in my experience. I worked in a team where I regularly heard of talk to fire people for failing phishing tests.

dsr_ 4y ago

All the ones that actually care about security do this. If you want people to fix their mistakes and change, you need to encourage them to do so. If you want people to try to hide their mistakes, punish them. (If you discover that IT has permanently reserved a backup laptop for a particular employee who is perpetually in need of a fresh image, it's time to talk to their manager about why they fall for these things and what other mistakes they might be making.)