Effective and Realistic Security Training?
-
I recently came across an article on eWeek that talked about Malware attacks shifting back toward the end user.
One of the quotes that really resonated with me was the following...
He also said that he was disappointed that education didn’t work as well as it should and that the only thing that seemed to work was after people had been the victims of an attack. This means that companies need to perform more realistic training, he said.
What does "more realistic" training look like? Does anyone have any examples of effective security training? What can you do to make security training "more realistic?"
-
I would have to say "more realistic training" would be paid penetration and phishing attempts.
That actually result in something like "you've put your self / company at risk" page etc.
-
@DustinB3403 So you're saying companies should essentially try to bait the employees into "mock phishing" attacks on their emails to prepare them for the real thing? Do you know if that is something that some companies are currently doing?
-
I know for a fact that many large companies do already perform this.
I can't recall who it is here on ML, maybe KnowBe4, but there are providers who offer this.
Obviously any successful attempts get logged, whom, IP, time etc etc, which a comprehensive list is then built at the end, and training delivered.
-
@DustinB3403 This is great. Thanks!
-
So this is very specifically something that we tackled when I was working in the big hedge fund world where security truly was job one and they did everything possible to train people for it. It meant many things, but in the context of "realistic" they did things like:
- Internal phishing email attacks
- They reported to the whole company which people fell for the scams and what they did (give away info, respond, etc.)
- They made every person sit through a peer and management review of them to see if they should be allowed to keep their jobs or not following the breach.
- Their failure was added to their permanent records.
- This was compared against previous potential exposures, breaches and failures to think in a secure manner.
- They did physical penetration testing on video.
- Real people broke into the offices using social engineering.
- The video was shared with the entire company and required to be watched.
- Every person that let the person in, didn't notice a stranger in the office, failed to report them, etc. was captured on video and similar circumstances as with the email were applied AND the entire company watched them on video as it happened.
- Regular "traditional" training with explanations, theory, etc.
- Users were required to participate, not just view.
- Users had to provide feedback
- Secure Thinking
- Peers and managers constantly watch each other and report and record on security-mindedness
- Internal phishing email attacks
-
@GlennBarley said:
@DustinB3403 So you're saying companies should essentially try to bait the employees into "mock phishing" attacks on their emails to prepare them for the real thing? Do you know if that is something that some companies are currently doing?
That's exactly what the highest security companies do. It's an established practice and I've had it done to me (and I passed, thankfully.) I've been a peer reviewer for someone that failed.
-
@DustinB3403 I like this approach a lot. It actually sounds a lot like the Chaos Monkey tool that is used in the testing/QA world to find failures in cloud-based software.
-
There's a company called KnowBe4 that does the email Phishing stuff... Not sure what else they do.
-
-
@scottalanmiller that seems like some extreme training.
-
@mlnews You would think, but if you read into the article that I linked above, it seems like people don't REALLY get the risk until they have become a victim.
-
That's why they really drove that home. If you fell victim to it they made it clear that you screwed up and you were now considered a vulnerability in the organization and they made it clear that you let the company down and were not up to par.
-
@scottalanmiller Unfortunate that those measure are necessary for users to really see the risk. But, at least for now, that seems to be the case...
-
@GlennBarley said:
@scottalanmiller Unfortunate that those measure are necessary for users to really see the risk. But, at least for now, that seems to be the case...
Yes, if you want security to really be driven home you need to make people realize that they are accountable. It is way too easy to feel like the security and the risks belong only to the company and to not care about them. You have to find a way to make people realize that all security falls on them including the risks.
-
Agreed, you have to get the onus onto the user. SMBs will almost never do this. So the training itself ends up being more of a waste of time and money.
You're better off removing as much access as possible from users, killing internet access, killing email, etc so they can't be tricked. Those seem like a better spend of your dollars.
-
@Dashrender said:
You're better off removing as much access as possible from users, killing internet access, killing email, etc so they can't be tricked. Those seem like a better spend of your dollars.
Read: Your best bet is to fire insecure staffers.
-
@scottalanmiller said:
@Dashrender said:
You're better off removing as much access as possible from users, killing internet access, killing email, etc so they can't be tricked. Those seem like a better spend of your dollars.
Read: Your best bet is to fire insecure staffers.
when you pay only 12/hr none of them care.
-
@Dashrender said:
when you pay only 12/hr none of them care.
Read: when you pay only $12/hr you don't care either
-
@scottalanmiller said:
@Dashrender said:
when you pay only 12/hr none of them care.
Read: when you pay only $12/hr you don't care either
Ok, at what point do you? $15? $20/hr?
