Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
How do you usually conduct a safe phishing exercise to test the staff's security awareness? How do you ensure that staff are not offended by such an exercise? Would you in some circumstances also include the CEO without letting him/her know about it?
I think in some areas it's quite a controversial thing to do in an organization. I am trying to find out if it's suitable for us to perform one for our organization to raise awareness.
I run a service that tests people and organizations in their ability to spot and properly respond to phishing attempts.
You must let all users know that a test will be performed, even the CEO. This does not mean that you inform them then try to phish them right away. With a few days delay, people will stop being on guard against a test.
How this is done, and if this is done, needs to up to your organization's management and HR department. Even with warning, people will feel entrapped, targeted, and possibly bullied. Warning helps to reduce these feelings and your HR department will help you devise a way for people to express their concerns, if any.
No one can tell you if it is appropriate to do this in your organization but your management. Do NOT launch a test without authorization and approval from your management.
First thing is not to do this without permission.
In order to prevent people from being offended, let them know a phishing test is going to be performed within the coming weeks.
Finally, if anyone falls victim to your phishing attack, it is important not to single anyone out. Anonymise their response in any report, and simply sum up the stats in order to measure its success.
e.g.
Emails sent = 100
Beacons received = 80
Clicks received = 50
Credentials harvested = 5
A big part of how people respond to these tests has to do with why they think the test is being given. People seem OK with running tests to measure the effectiveness of corporate training programs but less happy if they feel that they are being individually tested.
Make it clear that there is no reward or punishment for their performance on the test. There will be no special education or public embarrassment if they "fail". Instead, state that the data will be used to generate statistics for the company as a whole and measure how effective existing training is.
And you pretty much have to tell people beforehand that there will be some testing done because you need to educate them about what to do when they get a suspicious email before you test them. There are tools that you can use to support user-reporting of suspicious emails but forwarding an email to [email protected] may be sufficient. That training is a good time to let them know that there will be spot checking done to collect statistics on the effectiveness of training.
