Re: Phishing Simulation - Punitive Escalation

["Ullman, Catherine" <cende () BUFFALO EDU>]

My $.02 -

I don’t think there’s a global easy solution to this problem per se.  My experience overall is that sitting down with 
someone sooner than later to see if you can get them to explain the disconnect to you is key.  Usually it’s one of two 
things:  1. Someone who just doesn’t really understand – either because no one spent the time with them or they 
struggle with learning concepts for whatever reason.  2.Someone who just doesn’t care.  I think the important thing is 
to determine which of these two categories the “frequent” clicker falls into.  You can often help with #1 in a number 
of ways, including going out of your way to educate and reward them for getting it right.  You can’t do much about #2 
aside from provide documentation and ideally put in additional risk mitigation wherever possible.

Best,
Cathy


Dr. Catherine J Ullman
Senior Information Security Forensic Analyst
Information Security Office
University at Buffalo
cende () buffalo edu<mailto:cende () buffalo edu>



From: The EDUCAUSE Security Community Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU> On Behalf Of Frank Barton
Sent: Monday, May 18, 2020 12:25 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Phishing Simulation - Punitive Escalation

Ken, what is your escalation for "frequent clickers" then? The question that we have been struggling with is "If the 
message isn't getting through, how do you get it through?"

Frank

On Mon, May 18, 2020 at 12:20 PM Ken Connelly <ken.connelly () uni edu<mailto:ken.connelly () uni edu>> wrote:
I sold phishing education to our administration with the caveat that it would *never* be punitive. I think that's an 
important piece of our program.

-ken
On 5/18/20 9:51 AM, Gomez, Joshua wrote:
Hello
I wanted to ask what people are doing for a "path to escalation" for staff who repeatedly fail simulations or cause 
incidents?

For Example
First Failure -> Remedial Training
Second Failure -> Remedial Training + Supervisor Notification
Third Failure –> Remedial Training + Sit down with person and department head
Etc.

I’m just trying to get some ideas to bring to our Governance committee.  We have not been trying to be punitive and 
haven’t needed to do much, but we are starting to see repeat offenders that need coaching for behavioral changes.

Thanks in Advance,

Josh

Joshua Gomez| Analyst, Information Security
Information Technology Solutions






**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at https://www.educause.edu/community



--

- Ken

=================================================================

Ken Connelly                       Director, Information Security

Information Security Officer          University of Northern Iowa

email: Ken.Connelly () uni edu<mailto:Ken.Connelly () uni edu>   p: (319) 273-5850 f: (319) 273-3010



Any request to divulge your UNI password via e-mail is fraudulent!

**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at https://www.educause.edu/community


--
Frank Barton, MBA
Security+, ACMT, MCP
IT Systems Administrator
Husson University
PGP Key Fingerprint: 0249DC644EC78D2F6B5CD2C6C94D3EDB57946437

**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at https://www.educause.edu/community

**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at https://www.educause.edu/community