Phishing Your Employees for Schooling & Security

Practical tests are the best measure of understanding. Most security awareness training I've seen ends with a basic multiple choice test. These tests are only a partial measurement of whether or not the pupil can put that knowledge to use in the real world. Take a driving test, for instance. Sure, there's a written test, but you wouldn't allow a teenager on the road until after he passed the practical one, too.

Practical assessment can reveal training gaps. By sending fake phishing emails, you can learn which ones your users fell for most often. Was there a certain type of email that contained a certain "lure" that tricked your employees? Perhaps that might be a missing piece you can add to your next phishing training, or a concept you haven't covered in enough detail.

They help employees recognize their own level of understanding. Your fake phishing emails should immediately inform the user when they clicked on a bad link. The goal isn't to shame the user — that's detrimental to education. Rather, the goal is to let the user know they missed something, so they realize that they have a gap in their practical understanding, and don't overestimate their preparedness.

They provide another training opportunity. The best training involves repetition. Besides informing a student they've made a mistake, fake phishing emails allow you to immediately share training with the user that specifically addresses the mistake they just made. For instance, say a user clicked a link that obviously went to a domain having nothing to do with the email. After informing the user of their mistake, your phishing link could forward the user to a training page specifically telling them what to look for in URLs. In fact, these fake phishing exercises provide an easy way to regularly reintroduce training materials to your users (at least the ones making mistakes), without having to repeat a training course.

Practical tests are more likely to change behaviors. The true measure of security education is if its recipients change their bad behaviors. One reason some security pundits complain that training is ineffective is because of a certain type of user that knows the right behavior but continues to do the wrong one when it's easier. Failing these internal phishing tests regularly should eventually get even the most stubborn users to change their behavior, simply because they know their boss might be watching.  

They help you measure the actual value of your training. I believe that security training is effective, but not all training is equal. Phishing your own tank measures your training's efficacy. Send out fake phishing emails before your trainings and record the results. Then send similar emails out after the training and compare the results. Give your organization at least two cycles of training to really understand the long-term trends. (Education takes some time!) However, if you aren't seeing a change in behavior, then perhaps you should cancel that particular training course and identify one that works better. In any case, you're not going to be able to calculate this risk vs. efficacy vs. cost equation unless you actually measure how well your users do against phishing emails — and the only way to do that is to phish your company's tank. 

9 Phishing Lures that Could Hijack your 2017 Tax Refund

The 6 Riskiest Social Media Habits to Avoid at Work

IRS Warns Taxpayers of Email Scams

Best Practices for Lowering Ransomware Risk