Hacker News Reader

Comment by Nextgrid | Hacker News Reader

There are companies providing fake phishing messages as a service. Use those and attach penalties for repeat idiots. If they don't care about putting the company at risk, they might at least think about putting their own employment at risk.

Edit following the comments: maybe reversing the approach would work, by attaching monetary rewards to correctly reporting phishing emails? That would encourage everyone to be extra suspicious and report anything that looks amiss for the chance of getting some extra cash while avoiding the negatives of firing people on sight.

View on HN

You really don't want to do that.

We use one of those services, too, and you have to use a very light touch. Just using them at all makes people paranoid. If there are people you find who pose a risk, yes, you should do something about that, but terrorizing your workforce is a terrible idea for multiple reasons.

> putting their own employment at risk

Even looking at it amorally, that only really works in declining industries where people don't have a choice. Do that to engineers in a hot economy, and I suspect you'll be employing only the otherwise-unemployable soon.

About two years ago, where I worked really amplified up their phisting testing, and after the first batch when SO MANY PEOPLE failed (I heard the number was around 60%), they pushed out a new HR policy that included a suspension/termination for repeated offenders.

Less than 3 months later, HR was begging people to click the link in their email to set up their benefits for the year, because they had a 0% click-through rate.

Now thats some successful anti-phishing training.

Perfect!

Hang up, look up, call back.

This happens at my work but if you click on a link you need to do a phishing awareness training module. I think this is an effective approach because it doesn't seek to punish anyone but instead train them to be more aware.

That’s a good way to ensure everyone hates ITSec for punishing them despite having failed to provide an environment which is secure enough to survive someone clicking on a link in an email. That makes it less likely that people will report suspicious activity and gives a successful attacker a way to blackmail someone.

This time is much better spent securing the environment: spend the money on Yubikeys, lock down your default browser or use an isolation system, beef up your network filtering, etc. — things which can actually work and won’t make your users think you’re just trying to get them fired.

The problem I see with locking things down is that you can't lock down things that the user requires for their job. If the user legitimately needs access to some sensitive information for example, it's just a matter of time before they can be tricked by an attacker into doing something stupid with it. Yubikeys would solve the problem of the user giving away their credentials to the sensitive data but wouldn't stop the user directly giving away said sensitive data. Locking down is also a blacklist approach where you can miss something and it will be exploited when an attacker eventually gets lucky. I'd rather be the one getting lucky and catching those users early than waiting for an attacker to catch them.

I guess instead of a penalty a more user-friendly way would be to attach monetary rewards to reporting phishing emails? That would incentivize reporting anything that looks even just slightly suspicious, which is probably a better outcome from a security point of view even with false positives.

Depending on the size and culture of the company I feel like that's a pretty risky proposition unless you've got senior leadership really chomping at the bit right after a major incident. It's quite likely someone pretty high up in the company will fall for the fake phishing and then you've got a bunch of politics in your lap.

Reply on news.ycombinator.com