* An interesting approach to testing security awareness
I recently ran across a neat idea for security training. After providing employees with articles and PowerPoint training to help them identify and resist phishing attacks, you can test the effects of the training by creating your own phishing attacks using a fake site that looks like a company page but isn’t.
The fake site can ask visitors to enter their user IDs and passwords. Most employees (but not all) will resist the phishing simulation and either not visit the fake site at all or refuse to provide the requested confidential information. You can provide additional education in a nice way to the ones who get tricked.
I very much support the use of tests as an aid to increasing security awareness and measuring the effectiveness of awareness and training programs. There are a few provisos that can help you avoid trouble, though.
From a motivation standpoint, the most serious risk of testing is that employees can feel abused by what they might perceive as trickery or deceit. Even people who resist the tricks may resent the attempt. People who fail the test may feel even more angry or hostile.
I have long argued that the way to make tests acceptable is to engage the cooperation of the people who will be tested. As part of your awareness or training program, you can explain to your colleagues that they will be tested – not to punish individuals but as a measure of the effectiveness of the programs.
Going further, you can even make tests fun, in a geeky sort of way, by turning them into contests. For example, it costs very little to establish some enjoyable prizes for winners (perhaps randomly drawn from the pool of winners) such as T-shirts, fleece sweaters in cold climates, attractive windbreakers, or other desirable items. Even dinner for two at a nice restaurant might be appreciated and yet cost relatively little from a corporate standpoint. Gift certificates for a variety of stores (books, sports, clothing, hardware, food) might please people with different interests. The contest could be more elaborate, with teams competing against each other for cooperative fun and rewards.
The main point is to remember that few people enjoy being deceived, even if someone else thinks that it’s in their own best interest. Even fewer people enjoy being singled out as failures, and some of those can become nasty or even start thinking about lawsuits.
Make your tests honest, open and fun.
