Cybersecurity - Memes

1995 readers

1 users here now

Only the hottest memes in Cybersecurity

founded 1 year ago

MODERATORS

[email protected]

Alphadef

194

Does your company do phishing simulations? (feddit.org)

submitted 3 months ago* (last edited 3 months ago) by [email protected] to c/[email protected]

36 comments fedilink hide all child comments

We found out that 10% of our users entered their password.

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 12 points 3 months ago (1 children)

Phishing simulations should be about educating employees, not punishing them. Train them on what they missed and if training material is available check where it might be lacking. Nobody learns from having their bonus taken away. It also only serves to stimulate a culture were people prefer not reporting possible security issues they might have caused, in order to avoid further pay cuts.

[–] [email protected] 2 points 3 months ago

If someone is consistently falling for phishing emails (real, or from the IT department), shouldn't that person eventually be fired? Isn't that a punishment?

If there is neither a punishment nor a reward, what is the incentive to learn? Some people may not need one. Many others do.

I agree that a single failure resulting in the loss of significant income might be harsh, but I think there needs to be a way to convince people to take the issue seriously, and a punishment of some kind is therefore always warranted (e.g. eventual firing).

You can balance out the issue by creating a reward system as well, e.g. if you report all of the test emails sent to you in a year (i.e. not just ignore them), your bonus is increased by X% or something. Similarly, if you report an actual phishing email, your bonus is increased by some percent, even if you initially fell for it. I think it is possible to foster a consciousness and honest culture, with a system that includes punishments.