Habitu8 Webinar Outline: 5 Steps to Phishing Training Program Success
This webinar aired on July 31, 2018 (watch/listen here). Jason’s notes are as follows:
User Journey assumed: Awareness admin/CISO wants to start phishing users. STEPS TO SUCCESSFUL PROGRAMS:
1. Learn how the simulation processes work
- Pre-Implementation: All the work you do to get ready for the program
- Develop a plan
- Identify stakeholders
- Highlight technical needs & requirements
- Production: All the work you do while you’re managing the program
- Emails (and additional reporting data) are provided to the application, whether hosted vendor or open-source
- Email theme is chosen (click only, data entry, etc.) & “email” is customized/designed etc.
- Email education page is selected (what do you want to display to responders)
- Schedule & launch
- Annual Review: All the work you do to improve the program each year
2. Understand your environment and how it may present potential hiccups
3. Build a team and formalize a plan
4. Communicate, communicate, and then communicate some more
5. Reporting 101: know what you want to track and what story you want to tell
- Learn how the phishing training processes work, and how the user learning patterns emerge (for instance most learning happens between 3/4 campaigns)
- How many filters does an external email go through before it hits inboxes?
- Build your stakeholder team & thoroughly communicate the program with full transparency
- Ensure you have the required processes in place (reporting option, access to data, thorough whitelisting, IR plan, Helpdesk guidance)
- Understand how repeat responders develop, don’t identify them too early
1. Phishing Training Overview
2. Goals of a phishing training program
- General awareness on risk (having the discussion)
- Highlight proper response (behavior)
- Reduce IR response time
3. Mistaken Assumptions & Intentions
- Instant & accurate status of company risk (it will take several baseline campaigns to really understand what is going on within your environment)
- Focusing on just click rate (or getting click rate below 5%)
- Everything is working flawlessly
- People read what you put on education pages
- Phishing training equals security awareness training. WRONG. It is a core discipline within a robust awareness program.
- Industry patterns towards email security function taking over phishing training
4. Where to start?
- Program plan & mission statement
- What the program is
- Why you are doing it
- Who is included in the training
- Goals of the program:
- Our goal is to obtain average phishing report rate over 50% per campaign
- Our goal is to reduce average annual click rate to below 15%
- Our goal is to highlight the new reporting process
- Our goal is to increase co-worker awareness of phishing attacks
- Create stakeholder team
- InfoSec, IT (mail, support), GRC, Legal, HR, Corp Comm, Executive team
5. Vendors vs. open-source
- You have viable options depending upon resources & budget
6. Impact to program & resources
- Managing as a single resource
- Plan on 2-3 weeks per campaign for setting up, monitoring, reporting
- Managing with a team
- With a 2-3 person team, a campaign can be completed in a week with processes in place
7. Processes required to launch or improve your program
- Clear Reporting Method
- Helpdesk/IT Support
- Access to data & ability to export into required format
- Some vendor require data to be in specific format, doing work ahead of time to have automatic reports provided in specific format will save literally days of your time each year
- Metrics for reporting
- I used to do this manually using rules and filters in Outlook
- Using a button? Is it reporting properly & accurately?
- Click rate comes from dashboard
- Number of reports may need to come from Exchange/Mail filters
- Email servers
- Know your chain of delivery
- Filter-filter-filter-gateway-internal filter-user inbox
- Know your chain of delivery
- Domains (web access)
- Incident response plan
- Who responds when real reports are coming in? Next steps?
- Helpdesk/IT Support guidance
- Need to update a knowledge db for your support staff?
- Provide very specific guidance and instructions
8. Processes required for campaigns
- Security stakeholder notifications (24-48 hours prior to campaign)
- IT Support gets full details & proper guidance for reporting
- Senior leaders get reminded of proper guidance for reporting
- Never confirm it is a training/campaign - always confirm they’ve identified a phishing email, acknowledging they did the right thing by reporting & provide kudos
- Confirmation from Corp Comms no other company announcements during window
9. Program Terminology
- Repeat responder vs. “offender"
- Incident definition
10. What to focus on?
- Report response
- Short, direct
- Read in 10 seconds
- Behavior focused
- What should they do? REPORT
- Short, direct
11. What to know about phishing training learning patterns
- User learning won’t show until 3-4th campaign
- Let the process do its job
- Don’t assign blind training
12. What dictates repeat responders?
- Over 6-9 months, 3 responses
- After 4th’s campaign
- Will result in less than 1% of population
- Repeat Responder Program
- Problems with early identification
- More work for you
- More users than necessary
- Definitely provide full transparency on what the program is, what users should expect, what stakeholders should know, and how security stakeholders should respond.
- The success and adoption of the program will be crucial to how comfortable your users feel about it. If they think you’re tricking them or they’re getting in trouble, you will have a long road ahead.
- Clarify it is a training, not a test.
- Good data in, good data out
- Business Unit
- Privileged Users
- Employee Type
- New employee vs. seasoned
- Executive level
- Reporting Manager
- Protect this data
- Don’t provide “who clicked"
- Own your data.
15. Implementation Tips
- Don’t use logos or anything you don’t own trademark/copyright
- Click rates should constantly fluctuate, you’ll never have a negative trending pattern
- Simple can and will be effective
- Don’t start out high and mighty, go from simple to medium to hard
- Baseline - Focus on getting in 6-8 campaigns in year one