Timeline for Company does not want any names on phishing reports
Current License: CC BY-SA 3.0
20 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
Feb 5, 2018 at 10:21 | comment | added | xLeitix | As a non-expert I find this quite smart, because it avoids pretending that the tested individuals are the problem, and not the system / culture. | |
S Feb 2, 2018 at 14:00 | history | mod moved comments to chat | |||
S Feb 2, 2018 at 14:00 | comment | added | Rory Alsop♦ | Comments are not for extended discussion or for answering the question; this conversation has been moved to chat. | |
Jan 31, 2018 at 22:13 | answer | added | WoJ | timeline score: 3 | |
Jan 31, 2018 at 2:34 | answer | added | WGroleau | timeline score: 1 | |
Jan 30, 2018 at 21:06 | answer | added | Harper - Reinstate Monica | timeline score: 1 | |
Jan 30, 2018 at 14:28 | answer | added | Wadih M. | timeline score: 6 | |
Jan 30, 2018 at 14:21 | answer | added | Tom K. | timeline score: 49 | |
Jan 30, 2018 at 13:23 | comment | added | WernerCD | Hate to continually ask questions: If they deny detailed reporting and the results don't improve... who is culpable in the case of a breech? If you don't give good info - are you at fault? If they refuse the information, are they at fault? In other words - in a year when a breach happens... who is going to get sued? | |
Jan 30, 2018 at 13:18 | comment | added | schroeder♦ | Would they be open to breakdown by department/location/seniority? In my experience, this is extremely useful in helping to narrow in on areas that need help. And this way, you don't have to deal with individuals. Also from experience, I've seen this request before. And it's when the decision-makers don't want to be the ones identified ... | |
Jan 30, 2018 at 13:06 | comment | added | WernerCD | @pm1391 Ongoing... Are there different reports? "8 of 300"... vs detailed breakdowns by, say, repeat offenders? First runs are different than 5th runs - after being warned repeatedly. Is management unwilling to tackle repeat offenders (if you've gotten that far)? THAT would be a bigger issue... | |
Jan 30, 2018 at 13:02 | comment | added | WernerCD | Is this a single run phishing campaign? or ongoing? At a previous company, we had ongoing runs - monthly, quarterly... There were general reports (8 of 300) - and specific reports for management (those who ran the tests could tell who were repeat offenders). There's a difference between "Jill clicked the email once" and "Jill clicked the email 4 times in a row despite repeated classes and warnings"... More than once lead to increased visibility - and consequences. | |
Jan 30, 2018 at 12:59 | answer | added | Tom | timeline score: 22 | |
Jan 30, 2018 at 9:26 | comment | added | jpmc26 | "I politely accused them of checking a box and not actually being interested in educating their users." It isn't really possible to do that politely. | |
Jan 30, 2018 at 7:54 | history | tweeted | twitter.com/StackSecurity/status/958247054337339392 | ||
Jan 30, 2018 at 3:56 | vote | accept | pm1391 | ||
Jan 30, 2018 at 2:47 | answer | added | McMatty | timeline score: 129 | |
Jan 30, 2018 at 1:01 | answer | added | baldPrussian | timeline score: 153 | |
Jan 30, 2018 at 0:55 | review | First posts | |||
Jan 30, 2018 at 4:16 | |||||
Jan 30, 2018 at 0:53 | history | asked | pm1391 | CC BY-SA 3.0 |