Re:The ransomware surge
by viraptor on Friday April 30, 2021 @09:51PM
(#27002128)
> Shaming each individual user is the best way for them to learn.
It's the best way for them to stop trusting the security team and never come in with any issue, even if it could be used as an early signal preventing bigger attack. Many people's jobs rely on them receiving emails from unknown sources and receiving files from them. Shaming them for "you should've known this specific link is bad" is counterproductive. That's even before we get to whether they would actually put in any credentials.
Phishing tests have value. Running them to shame people into compliance is a waste of time.
It's the best way for them to stop trusting the security team and never come in with any issue, even if it could be used as an early signal preventing bigger attack. Many people's jobs rely on them receiving emails from unknown sources and receiving files from them. Shaming them for "you should've known this specific link is bad" is counterproductive. That's even before we get to whether they would actually put in any credentials.
Phishing tests have value. Running them to shame people into compliance is a waste of time.
For better takes, there's a good thread https://twitter.com/hacks4pancakes/status/133487573995560550...