In re comparing fire drills to phishing tests[1], if phishing tests were like fire drills, they would test the *response* to a successful phish. Was the person phished able to rapidly report and mitigate things? Do the organization's phish alarms work and reach people? Etc etc.
Current "phishing tests" are like testing people to see if they accidentally start fires if they're handed (dangerously) flammable materials. That's not a fire drill.
1: https://infosec.exchange/@sambowne/112513766095541271
Chris Siebenmann /
npub16g…5g9hv
2024-05-27 22:47:50
Author Public Key
npub16gknu73hfrmy6enushmtcq4yuyk3ml0aeadk7fj5hapws3mewyfq45g9hvPublished at
2024-05-27 22:47:50Event JSON
{
"id": "63c82cf781b53c9de7a1e25867d8411a73cf085f1d82cb2f4d15fc7f1f6f7f8c",
"pubkey": "d22d3e7a3748f64d667c85f6bc02a4e12d1dfdfdcf5b6f2654bf42e847797112",
"created_at": 1716850070,
"kind": 1,
"tags": [
[
"proxy",
"https://mastodon.social/users/cks/statuses/112515486209978619",
"activitypub"
]
],
"content": "In re comparing fire drills to phishing tests[1], if phishing tests were like fire drills, they would test the *response* to a successful phish. Was the person phished able to rapidly report and mitigate things? Do the organization's phish alarms work and reach people? Etc etc.\n\nCurrent \"phishing tests\" are like testing people to see if they accidentally start fires if they're handed (dangerously) flammable materials. That's not a fire drill.\n\n1: https://infosec.exchange/@sambowne/112513766095541271",
"sig": "cd22c93e49d29eacfe95e89dc46e4f9bc14c357f39273b63f265fbc3c9376d85ca6aed86ee68c95deb3eca9075be0bf3052c29fc4505ed7ee01cb1898aaa4c98"
}