What is Phishing Simulation and should you phish your own employees?
Ayman explains that phishing simulations should focus on education and preparedness rather than tricking employees, emphasizing the importance of empathy and emotional intelligence in designing these campaigns. He advises avoiding topics that could hurt employees' feelings, such as fake bonus emails, and recommends ensuring employees know how to report phishing attempts properly. Ayman also highlights the need to understand an organization's culture before implementing any security program and suggests using phishing campaigns sparingly, only after sufficient education has been provided.
Transcript
Only Ayman's parts of this conversation are included, with the question before each answer for context.
I'm Doug Meyer, Director of Information Security and Data Governance at Gordon and Reese LLP. We're a nationwide law firm in the United States. I manage the information security program in its many aspects, including our phishing awareness program. And that's part of what we do. Did we let a lawyer in? I'm not a lawyer. I don't play on TV. Awesome.
Ayman, you're up, sir. Hi, I'm Ayman Elsawah, founder and chief vCISO at Cloud Security Labs. I help startups get their security programs leveled up and in place, and so happy to be here.
Talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria talk on information security covering CISO, vCISO, red team, threat modeling, Enterprise Security Weekly, Security Cafe, Getting Into Infosec, Ayman Elsawah, Adrian Sanabria
You know, my approach is, you know, if you're going to do a phishing campaign, don't set your employees up for failure, right? So we all know that, you know, the big justification that people say why they should do it is like, oh, well, the attackers do it. Well, yeah, that's true. The attackers do it. And so are you preparing them if an attacker does do a phishing campaign? You know, do you have them... Do they know what buttons to press to report a phish? Do they know where to send, you know, is there a security ad or is there a phishing ad email for them to notify people of a phishing, you know, campaign, things like that. 5:07 So if you're going to send a phishing campaign, you know, they need to be prepared on what to do. And then of course, definitely stay away from like certain topics. I've seen some failures myself firsthand of people sending bonus emails, During, you know, end of year and people got, people's feelings are hurt. And, and I would recommend using a lot of empathy and emotional intelligence in your, you know, because sometimes, I mean, you got to put yourself in their feet, right? 5:39 And I'll defer to the psychologist for, for, for that. But, you know, like using a good amount of emotional intelligence and empathy and, you Just compassion for them. You know, at the end of the day, you're trying to educate them and have them do better. And you're not trying to like get them and bait them out there. And my one minute is over.
Cybersecurity teams are thinking about and self-awareness which is really the operative human function psychological function or mechanism that's at play in terms of what people are doing and what they're aware of or not aware of doing and the phishing test itself does almost nothing to assess or address self-awareness and that's a missing link here in the whole system
Got it.
Yeah, well, first response is we have to do a lot of education when we're rolling out or continuing a phishing program to be respectful to our employees. I think part of what I'm hearing so far is based on an assumption, at least somewhat,
That phishing programs are 100% effective.
Don't send shit. Here's three examples. You'll remember it for a few days until craziness happens again. And then we're screwed. And then it's useless. You've got the tick in the audit box and the compliance box. Congratulations. You can feel good about yourself. But that's it. It's worse than useless. It's that false sense of security. And this is, you know, again, this is why I love hanging out with Gabrielle and the team. It's the whole continual shenanigans of like, okay, let's continue to educate and help people. All right, Ayman, you were going to hit on something on this one.
Yeah, I mean, you know, there's a couple of things. So one, sometimes your boss expects you to do it. So, you know, say you're the new CISO and your boss might be the CEO or CFO, whoever it may be, and they expect you to do it. Like, hey, why haven't you done any phishing campaigns? And you're going to tell them, well, we shouldn't be doing it. So that's one. But two, I think You know, there's a big lack of data metrics that we have in security overall, in general. 20:22 We struggle with like measuring things. And so doing a phishing campaign helps us measure something. It might not be the right thing. It might not be the, you know, the thing, but like we are, there's a drought of data in our just day-to-day stuff. So, you know, It's tough. It's tough. So I think that's why to touch upon why we do things, you know, we're just grasping for things. Now, if we were a little more wiser, we understand that the main goal is to educate people. 20:58 So hopefully you've done the education before you've done the phishing campaign. And heck, you know, if you've done a good job, maybe you'll warn them, hey, then in this quarter, we're going to do a phishing campaign. And you don't need to phish them every quarter. I think, I think that's like just kind of, that's wild. Like, Once a year maybe depending on the culture again it comes back to culture i wrote a whole article about this and one of the things was understand the culture of your organization are you a bank or are you like scrappy startup or you know or someone in the middle so you know just understanding your culture will help a lot doug what you got on this one sir i'd say understanding your culture is very key for any security program in any organization so
Interesting.
How many people does that team have that they're doing security phishing? I mean, do they have everything else in place? MFA and...
So if something legitimate is happening, let's say the CEO asks the CFO to transfer funds, a legit transaction, not like a bogus one. Can we somehow check that the actual CFO follow the process and call to verify with the CEO? For example, like, can we verify that the processes that we have are working? With, and that, I don't know how to do that, but that's something that I think, you know, we need to just make sure that the processes are working.
So I think that's a good one. So basically my perspective, let's talk about the operational part, right? You mentioned perimeter, but there's also the concept of zero trust. So, and, and culture. So all of this can tie together. So for example, first of all, a lot of people are getting phished all the time anyway. Okay. So there's enough phishing emails coming in, actual phishing emails. So one, are they reporting it properly? So do they know which button to press? 33:50 There's actually a button in G Suite or workspaces and 365 where you can report a phish. And that's going to help the providers to prevent more of these emails, right? Do you have DKIM and SPF set up properly, right? 365 has... A spear phishing category where you can put executives in this category and they'll have extra protection are you doing that like do all these things first right and set up the infrastructure and so that we can reduce the number of phishing attacks to begin with and you know i saw one organization set up a slack bot said if someone reports a phish it was just like there's a bot that would actually walk them through a process that's awesome right 34:37 You know, you could also search, if someone does report it, then you can search all these other inboxes and remove these things, right? So, do you have all these processes in place to remove nasty emails from people's inboxes? But then, on the other side, if your organization is like, hey, give everybody admin and whatever, and you are struggling to reduce your attack surface, you're like, well, You know, I'm going to have to do some phishing. And so see, you know, and prove, I'm just kind of being devil's advocate here, and prove that one phish email I can get, and this is a red team part, you know, Chris, I'm appealing to you, you know, and you're trying to make the case, we need to have less admins, we need to have less admins on their laptop, all that kind of stuff, and you're getting pushback, well, you need to prove somehow that, you know, you can do it. 35:30 And maybe even just do a full, you know, do a red team. Say, I'm going to do a red team. I need to get... Green light for this and prove to you, you know, so.
You cannot get risk to zero. And so the system needs to accommodate the reality of who people are and how they behave and how they think. And that has to include tremendous variability. It cannot be homogenous. And that means that whatever is happening that's causing four people out of 100 to click You need to start by understanding what's going on for those four people and then extrapolate that back out to the hundred.
Yeah, I would say, yeah, I would say more on the why, just like Dr. Stein said, you know, put your product manager hat on, Gabriel, you might appreciate this, you know, put your, you know, be problem oriented, not so solution oriented. Find out what the problem is. Schedule a Zoom call with that person. Why not? Like, Get on and take that extra mile like you know a lot of times security folks sit behind their email sit behind their you know we want to avoid the ivory tower you know whatever it is like you know if you if your employees think the security team live in ivory tower then you have an issue you have a cultural issue and you need to even not think about phishing campaigns you need to you need to step back and get you know talk to the people so you know 40:46 Go the extra mile be have those better bedside manners right like just be that better person kick up that empathy and find out why i mean maybe they're having a bad day i don't know i don't know why you know and if you have to then we could talk about controls but let you know find out more about the problem before you go to the solution
Let's just go up against the human. It's more fun. Is that because it first started out as a tool basically of abuse? And it was born out of the fact that it was used to abuse people. And unfortunately, that mentality is carried on. No, people don't see it as a tool for education or for help. They see it because they remember from 20 years ago, When they did get their ass in because the big hairy thing decided to basically walk in through their computer. I wonder if that's a big part of it as well.
I mean, the fact is that 90%, up to 90%, according to some vendors out there, of attacks are from phishing. So it's just happening now, right? So you can be conservative and say 60% or 70% or 80%, but that's my two cents on that.
This isn't an infosec problem. These questions, these comments, these thoughts have been asked over the centuries. We've had to look after ourselves as humans. All we're now doing is translating that into a digital world. So it shouldn't just be an infosec. Somebody said, hey, HR should own it. And I'm like, actually, no, we should collaborate with HR and legal and compliance. This isn't ours. This is everybody's. Go for it, Ayman.
Yeah, so, you know, some of the things I've come to discover by myself, like, so I've come to like educational psychology lately. And in some of the work that I do, helping others like get into security in the podcast that I do, I've come to learn about neuroscience educational psychology and i've and even in the work what i do with my clients i've come to learn that as a security practitioner you are an education professional whether you like it or not your job is oftentimes to educate people because you know i'll get pushback on like say why should i do DevSecOps or devops or why should i automate things i'm like okay so let's you know let's let's walk through that so 57:27 It's amazing what Gabriel and Dr. Stein said, you know, let's, I mean, I would, I would say, let's take that education approach that we would take to a kid and use it on our people, employees as well, right? Create a safe space for them to ask that question. You know, create a safe space for them to ask that question, handhold them, but really focus on the education and, you know, you're going to win, you know, at the end of the day. If you take that approach.
Hey man, you're up sir.
I think we said enough. We said a lot. So my only two cents would be watch this webinar again before you do a phishing campaign.