Comment on Study concludes cybersecurity training doesn’t work

TheAsianDonKnots@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago

• 14th_cylon@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago

  no. training costs time and money, so if it has zero effect, then no training is clearly better.

  source

  • TheAsianDonKnots@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago

    I guess I don’t understand the metric of success. My training at work has helped me recognize risks more than most of my family that has no idea what root domain URL scam is. Did most of my family fail? Yes. Did 20% learn something and avoid risk? Yes.

    In large companies the training is for liability purposes, “see they all passed their tests, we tried to warn them”. People are always going to be the attack vector, that’s unavoidable… but 20% success is better than 0% success. As an admin, if I received a 20% spike in phishing reports, that’s statistically significant and should be looked into and stopped (proxy violation).

    Cost of training is unavoidable and budgeted for.

    source

    • 14th_cylon@lemmy.zip ⁨3⁩ ⁨weeks⁩ ago

      I guess I don’t understand the metric of success.

      i guess you will find if you read the study mentioned in the article.

      it is certainly possible that the study, or its interpretation in the article, is bs - i did not read either one of them. i am just stating in the vacuum that if something does not work (which is what that headline presents as conclusion of the study), then wasting time and money on it is worse than doing nothing.

      source
    • furrowsofar@beehaw.org ⁨3⁩ ⁨weeks⁩ ago

      Some of it is useful but IT practices that waste my time mean I get less done, makes me work more unpaid overtime, and destroys innovation and the company in the long run because more and more things need permission. You cannot run an imnovative organization that way.

      source
    • CH3DD4R_G0BL1N@sh.itjust.works ⁨3⁩ ⁨weeks⁩ ago

      Yeah it’s been a few years and I don’t remember what at this point, but my training has taught me a new scam or two before.

      source
• kopasz7@sh.itjust.works ⁨3⁩ ⁨weeks⁩ ago

  Maybe not if it only gives a false sense of security.

  source