Conversation

Notices

1. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Tuesday, 25-Mar-2025 02:42:56 JST Kevin Beaumont

   The cyber awareness industry - phishing simulators and such - is almost all complete garbage, just so y'all know.

   If you look at your proxy logs, you'll quickly discover you've got entire departments whose job involves opening links and documents from people unknown (also almost every manager does it, when reviewing CVs etc).

   If your security depends on nobody clicking a bad link, security and IT fucked up their jobs, and awareness training is just a sticking plaster on your own poor choices.

   • Doughnut Lollipop 【記録係】:blobfoxgooglymlem: likes this.
   • Embed this notice
     Lesley Carhart :unverified: (hacks4pancakes@infosec.exchange)'s status on Tuesday, 25-Mar-2025 02:51:23 JST Lesley Carhart :unverified:

     in reply to

     @GossiTheDog it was a good general idea that went horribly wrong, just beyond the pale in practice

   • Embed this notice
     Lesley Carhart :unverified: (hacks4pancakes@infosec.exchange)'s status on Tuesday, 25-Mar-2025 02:56:23 JST Lesley Carhart :unverified:

     @GossiTheDog I have had clients that just blanket fire anyone who clicks. Doesn’t matter their tenure or role.

   • Embed this notice
     Richard Stocks (richardstocks@infosec.exchange)'s status on Tuesday, 25-Mar-2025 08:12:03 JST Richard Stocks

     • Lesley Carhart :unverified:

     @GossiTheDog @hacks4pancakes One of the most interesting talks I’ve seen in recent years was about how an org had applied their overall culture of zero blame in safety incidents to security as well.

     Just as the driver for safety is to use incidents as a learning exercise, taking the same approach with security incidents led to an environment where people felt safe to report mistakes, knowing that they wouldn’t be reprimanded or suffer any consequences.

     Result?

     Everyone feels comfortable to report even issues proactively, which has put the response teams on the front foot and measurably improved their overall security posture.

     They also scrapped the fake phishing campaigns, which were felt to be creating a feeling of “they’re always trying to trick us or catch us out.”