Why you shouldn't train employees for security awareness

[InfoSec News <alerts () infosecnews org>]

http://www.csoonline.com/article/711412/why-you-shouldn-t-train-employees-for-security-awareness

By Dave Aitel, Immunity Inc.
CSO
July 18, 2012

If there's one myth in the information security field that just won't 
die, it's that an organization's security posture can be substantially 
improved by regularly training employees in how not to infect the 
company. [Editor's note: See Joe Ferrara's recent article 10 
commandments for effective security training.]

You can see the reasoning behind it, of course. RSA got hacked from a 
Word document with an embedded Flash vulnerability. A few days later the 
entire company's SecureID franchise was at risk of being irrelevant once 
the attackers had gone off with the private keys that ruled the system.

But do phishing attacks like RSA prove that employee training is a must, 
or just the opposite? If employees and/or executives at RSA, Google, 
eBay, Adobe, Facebook, Oak Ridge National Laboratory and other 
technologically sophisticated organizations can be phished, doesn't that 
suggest that even knowledgeable and trained people still fall victim to 
attacks?

One of the best examples ever of the limitations of training is West 
Point's 2004 phishing experiment called "Carronade." Cadets were sent 
phishing emails to test their security. Even after undergoing four hours 
of computer security training, 90 percent of cadets still clicked on the 
embedded link.

Fundamentally what IT professionals are saying when they ask for a 
training program for their users is, "It's not our fault." But this is 
false—a user has no responsibility over the network, and they don't have 
the ability to recognize or protect against modern information security 
threats any more than a teller can protect a bank. After all, is an 
employee really any match against an Operation Shady RAT, Operation 
Aurora or Night Dragon? Blaming a high infection rate on users is 
misguided- particularly given the advanced level of many attacks.

[...]

--
Learn how to be a Pen Tester, CISSP, ISSMP, or ISSAP with Expanding Security online.
Come to a free class and see how good and fun the program really is.
http://www.expandingsecurity.com/PainPill