Educause Security Discussion mailing list archives
Re: Initial Phishing Simulation - Do you tell them first?
From: Neal O'Farrell <neal () SCHOOLEDINSECURITY ORG>
Date: Thu, 13 Jun 2019 08:41:10 -0400
I don't come from a university background but have developed many phishing campaigns over the years. My preference has always been to make all employees aware in advance that phishing is being phased in as part of an overall awareness improvement campaign or culture. Then start the campaign a couple of weeks after that communication - and there may have to be a couple of communications first. I find that two weeks is usually enough time for most employees to forget that a phish test is on the way, but then remember, when reminded, that they were told it was coming. A happy medium that doesn't impact baseline testing. Most humans, especially at work, don't like to feel they've been tricked or duped, made a simple mistake, made to look foolish etc. When employees get angry that they're being unfairly (in their minds) tested, it hurts the entire goal of a culture of vigilance. Neal. Neal O'Farrell Schooled In Security www.schooledinsecurity.org neal () schooledinsecurity org (925) 914 0248 (EST) Security is fundamentally a battle of body parts - between the brain and the index finger. For the enemy to lose, the brain must win. On Wed, Jun 12, 2019 at 9:51 PM David Eilken < david.eilken () domail maricopa edu> wrote:
All, I have seen some threads on phishing in the past, but have a very specific question. When you started your phishing campaign/ program, did you notify your staff / faculty that the stimulations were coming (and not to worry about getting in trouble for failing)? I know KnowBe4 suggests not informing the population prior to doing a baseline. I've heard some pretty bad horror stories about the faculty not being too happy about getting a test phishing email sprung on them out of the blue. I personally don't see a huge upside to not letting them know what the broader campaign is about and how it supports the infosec program. I would be surprised if it would scewd the results much. We already send out notifications when a real campaign is active. Appreciate your input. Hope your enjoying the summer. Best, Dave -- [image: Maricopa Community College District Office logo] DAVID EILKEN MARICOPA COMMUNITY COLLEGES Information Security Officer | ITS 2411 West 14th Street, Tempe, AZ 85281 david.eilken () domail maricopa edu https://www.maricopa.edu/ O: 480-784-0637 LinkedIn <https://linkedin.com/school/maricopa-community-colleges>| Twitter <https://twitter.com/mcccd>| Facebook <https://www.facebook.com/maricopa.edu>
Current thread:
- Initial Phishing Simulation - Do you tell them first? David Eilken (Jun 12)
- Re: Initial Phishing Simulation - Do you tell them first? Scott Stoops (Jun 13)
- Re: Initial Phishing Simulation - Do you tell them first? Dennis Bolton (Jun 13)
- Re: Initial Phishing Simulation - Do you tell them first? Sonder, Henk E. (Jun 13)
- Re: Initial Phishing Simulation - Do you tell them first? Valerie Vogel (Jun 13)
- Re: Initial Phishing Simulation - Do you tell them first? Jason Fried (Jun 13)
- Re: [External] Re: [SECURITY] Initial Phishing Simulation - Do you tell them first? Gregg, Christopher S. (Jun 13)
- Re: Initial Phishing Simulation - Do you tell them first? Brad Judy (Jun 13)
- Re: Initial Phishing Simulation - Do you tell them first? Rob Milman (Jun 13)
- Re: Initial Phishing Simulation - Do you tell them first? Valerie Vogel (Jun 13)
- Re: Initial Phishing Simulation - Do you tell them first? Scott Stoops (Jun 13)
- Re: Initial Phishing Simulation - Do you tell them first? Ken Connelly (Jun 13)
- Re: Initial Phishing Simulation - Do you tell them first? Neal O'Farrell (Jun 13)
- Re: Initial Phishing Simulation - Do you tell them first? Hart, Michael (Jun 13)
- Re: Initial Phishing Simulation - Do you tell them first? Neal O'Farrell (Jun 13)
- Re: Initial Phishing Simulation - Do you tell them first? Watkins, Jameson (Jun 18)
- Re: Initial Phishing Simulation - Do you tell them first? Brian Basgen (Jun 13)
- Re: Initial Phishing Simulation - Do you tell them first? Hart, Michael (Jun 13)
- <Possible follow-ups>
- Re: Initial Phishing Simulation - Do you tell them first? Eric Sawyer (Jun 13)
- Re: (WARNING) Re: [SECURITY] Initial Phishing Simulation - Do you tell them first? Richard Siedzik (Jun 13)
- Re: Initial Phishing Simulation - Do you tell them first? David Eilken (Jun 17)