More and more, I'm coming around this this point of view: don't phish your employees. benthamsgaze.org/2017/08/22/sho…
Most users get a minimum of at least 10 mails a day or so that all basically say "click here, then log in" *and that are legit*. They're continually being _trained_ to do this.
Instead of phishing them (with overwhelming success, of course), we (the industry) should make sure that (1) clicking on things doesn't pwn you, and (2) legitimate mails are obviously legitimate.
(The second part is particularly tricky: all your 3rd party services, your HR-, payroll-, insurance-, 401k-, ... mails are all phishy af.)
Humans will always remain the weak point. They _will_ click. The way to minimize the risk of spear phishing is via DKIM, SPF, 2FA (FIDO U2F), password managers, zero-trust, safe & sandboxed browsers, etc.
Our browsers, our emails should be _safe_ to use. Even if used incorrectly.
netmeister.org/blog/its-the-p…
netmeister.org/blog/its-the-p…
If you phish your employees, how do you measure the success of your phishing program? Fewer people click over time, more people report your phishes, more real phishes reported...? Are those meaningful metrics?
The problem I see is that no matter what you're measuring, you're likely misleading yourself. There's significant risk that you're only measuring how well your employees can detect _your_ phishes, while at the same time frustrating your employees.
The phishing team will always win. Anybody in infosec can craft a phish that you will click on -- "Gotcha!" -- but that leads to lost trust amongst employees, feeling tricked.
Many phishing programs consider a click a compromise; but many of the clicks come from employees who correctly identified the phish as internal, knowing it's safe.
So measuring clicks seems misleading, especially compared to the proportional risk: real world watering-hole attacks relying on browser (or, more likely, Flash) exploits seem less frequent than credential phishing via fake login sites.
Seems to me you need to measure clicked-and-submitted-valid-credentials. Which is a bit harder to outsource, I suppose. But even then, you need to be aware of what it is you're measuring the success of:
The only thing a phishing program can measure is the effectiveness *of your training*, _not_ of your phishes! That is, you actually have to have anti-phishing training besides (and prior to) sending phishes. You're not mesuring your employees, you're measuring yourself.
