Do phishing tests do more harm than good? - Wolfgang Goerlich - ESW #376

Security Weekly Podcast Network (Video)

内容由Security Weekly Productions and Security Weekly提供。所有播客内容（包括剧集、图形和播客描述）均由 Security Weekly Productions and Security Weekly 或其播客平台合作伙伴直接上传和提供。如果您认为有人在未经您许可的情况下使用您的受版权保护的作品，您可以按照此处概述的流程进行操作https://zh.player.fm/legal。

2M ago 34:21

MP4•单集首页

A month ago, my friend Wolfgang Goerlich posted a hot take on LinkedIn that is less and less of a hot take these days.

He posted, "our industry needs to kill the phish test",and I knew we needed to have a chat, ideally captured here on the podcast.

I've been on the fence when it comes to phishing simulation, partly because I used to phish people as a penetration tester. It always succeeded, and always would succeed, as long as it's part of someone's job to open emails and read them. Did that make phishing simulation a Sisyphean task? Was there any value in making some of the employees more 'phishing resistant'?

And who is in charge of these simulations? Who looks at a fake end-of-quarter bonus email and says, "yeah, that's cool, send that out."

Segment Resources:

Phishing in Organizations: Findings from a Large-Scale and Long-Term Study
The GoDaddy Phishing Awareness Test
The Chicago Tribune - How a Phishing Awareness Test Went Very Wrong
University of California Santa Cruz - This uni thought it would be a good idea to do a phishing test with a fake Ebola scare

Show Notes: https://securityweekly.com/esw-376

4306集单集