Effective and Realistic Security Training?
-
@GlennBarley said:
@DustinB3403 So you're saying companies should essentially try to bait the employees into "mock phishing" attacks on their emails to prepare them for the real thing? Do you know if that is something that some companies are currently doing?
That's exactly what the highest security companies do. It's an established practice and I've had it done to me (and I passed, thankfully.) I've been a peer reviewer for someone that failed.
-
@DustinB3403 I like this approach a lot. It actually sounds a lot like the Chaos Monkey tool that is used in the testing/QA world to find failures in cloud-based software.
-
There's a company called KnowBe4 that does the email Phishing stuff... Not sure what else they do.
-
-
@scottalanmiller that seems like some extreme training.
-
@mlnews You would think, but if you read into the article that I linked above, it seems like people don't REALLY get the risk until they have become a victim.
-
That's why they really drove that home. If you fell victim to it they made it clear that you screwed up and you were now considered a vulnerability in the organization and they made it clear that you let the company down and were not up to par.
-
@scottalanmiller Unfortunate that those measure are necessary for users to really see the risk. But, at least for now, that seems to be the case...
-
@GlennBarley said:
@scottalanmiller Unfortunate that those measure are necessary for users to really see the risk. But, at least for now, that seems to be the case...
Yes, if you want security to really be driven home you need to make people realize that they are accountable. It is way too easy to feel like the security and the risks belong only to the company and to not care about them. You have to find a way to make people realize that all security falls on them including the risks.
-
Agreed, you have to get the onus onto the user. SMBs will almost never do this. So the training itself ends up being more of a waste of time and money.
You're better off removing as much access as possible from users, killing internet access, killing email, etc so they can't be tricked. Those seem like a better spend of your dollars.
-
@Dashrender said:
You're better off removing as much access as possible from users, killing internet access, killing email, etc so they can't be tricked. Those seem like a better spend of your dollars.
Read: Your best bet is to fire insecure staffers.
-
@scottalanmiller said:
@Dashrender said:
You're better off removing as much access as possible from users, killing internet access, killing email, etc so they can't be tricked. Those seem like a better spend of your dollars.
Read: Your best bet is to fire insecure staffers.
when you pay only 12/hr none of them care.
-
@Dashrender said:
when you pay only 12/hr none of them care.
Read: when you pay only $12/hr you don't care either
-
@scottalanmiller said:
@Dashrender said:
when you pay only 12/hr none of them care.
Read: when you pay only $12/hr you don't care either
Ok, at what point do you? $15? $20/hr?
-
@Dashrender said:
Ok, at what point do you? $15? $20/hr?
At the point where you are able to start hiring staff that cares. It's that simple. If you determine that $12 cannot get you secure staff, then paying $12 means you don't care. If paying $18/hr gets you staff that cares, that's how much you need to pay if you care.
That $12 means you don't care was based on the foundation of your statement.
-
OK that makes sense.
The the larger problem is making the company care in the first place. Most places, including huge corporations wouldn't fire people over this. Until that trend changes, the other doesn't matter.
-
@Dashrender said:
The the larger problem is making the company care in the first place. Most places, including huge corporations wouldn't fire people over this. Until that trend changes, the other doesn't matter.
I agree with the problem of making the company care... but that doesn't mean we shouldn't train the end users... Even if 1 person learns something, we've don our job.
-
@Dashrender said:
The the larger problem is making the company care in the first place.
Is it? If the company doesn't care, you shouldn't either. Making it not a problem at all.
-
@dafyre said:
@Dashrender said:
The the larger problem is making the company care in the first place. Most places, including huge corporations wouldn't fire people over this. Until that trend changes, the other doesn't matter.
I agree with the problem of making the company care... but that doesn't mean we shouldn't train the end users... Even if 1 person learns something, we've don our job.
To what end though? Spending the money but effectively getting zero security gain on the company to me is just wasting money. Even if you get 50% to sit up an listen and care, the other 50% can/will bring your company to it's knees.
This must start with the company caring first.
Unless I'm missing something? -
@dafyre said:
Even if 1 person learns something, we've don our job.
If the company doesn't care, what makes this our job? I think the core thing here is not feeling that things are our jobs that the company has not made our jobs. It's less of an issue that a company doesn't prioritize this, but that we often prioritize it on our own.
