Re: Faculty Acceptance of Security Awareness Education?

[Terri Jones <terrij () WEBSTER EDU>]

Matthew,

I looked into PhishMe, and it's pretty slick. But in discussing it  
with other IT managers, we really hesitate to "entrap" users into  
doing the things we tell them over and over not to do. What has been  
your experience with this aspect, and are there ways of using the  
service other than tricking users? I'm not trying to be troublesome,  
just looking for another perspective, as this is the impression the  
service gave to my colleagues.

Thanks,
Terri Jones


************************************************
Terri Jones
Director, IT Information Services
Chief Information Security Officer
Webster University
470 E. Lockwood Avenue,
St. Louis, MO 63119
terrij () webster edu / (314)246-7953





On Nov 17, 2009, at 11:59 AM, Matthew Wollenweber wrote:

> I've thought on this problem a lot recently. I haven't yet tried to  
> push the plan through management, but the most reasonable approach  
> to me seems to be targeted and automated training. Most malware we  
> see is the result of trojans, which means user interaction is  
> generally required. When we remediate the system, it would be easy  
> enough to sign the user up for a phishing/trojan awareness training  
> through a service like phishme.com. That way users that have  
> problems get training, training functions as a test of sorts, and  
> it's automated so the employee isn't defensive about what they were  
> doing that led to the compromise. Again, this isn't implemented but  
> in my opinion it feels like an unresolved problem when we remediate  
> a system for a trojan with little or no training/interaction with  
> the user and this is the best solution I've had on the subject.
>
>
>
> On Wed, Oct 28, 2009 at 6:21 PM, Jon Good <Jon.Good () ucop edu> wrote:
> Researching a question posed by our Academic Senate leadership:
>
>
>    What approaches have worked at other institutions to persuade  
> faculty to get on the security awareness bandwagon [take the  
> “training”]?
>
>
>
> Jon Good
> Director, Information Security
> Information Resources & Communications
> University of California Office of the President
> 415 - 20th Street, 3rd Floor
> Oakland, CA 94612-2901
> (510) 987-0518
>
>
>
>
>
> --
> Matthew Wollenweber