How to keep your cybersecurity test from going off the rails

West Mid­lands Trains hit head­lines after a com­pa­ny-devised phish­ing test tricked its own employ­ees into believ­ing they were in line for an annu­al bonus. Rail unions were quick to deride the cyber­se­cu­ri­ty exer­cise, describ­ing it as “crass and rep­re­hen­si­ble” and a “cyn­i­cal and shock­ing stunt”. 

How­ev­er, the train oper­at­ing com­pa­ny claimed: “The design of the email was just the sort of thing a crim­i­nal organ­i­sa­tion would use – and thank­ful­ly it was an exer­cise with­out the con­se­quences of a real attack.”

Accord­ing to the most recent fig­ures from the Depart­ment for Dig­i­tal, Cul­ture, Media and Sport, 39% of busi­ness­es report­ed a cyber­se­cu­ri­ty breach in the 12 months between March 2020 and 2021. Phish­ing attacks, an email scam that imper­son­ates a trust­ed enti­ty in a bid to per­suade vic­tims to share their per­son­al details, were the most preva­lent, account­ing for 83% of all cyber­se­cu­ri­ty breach­es on busi­ness­es.

Secu­ri­ty soft­ware provider Check Point’s region­al direc­tor Ian Por­te­ous believes the cur­rent spate of phish­ing attacks makes this type of test exer­cise very use­ful, but adds: “Tar­get­ing trans­porta­tion work­ers, who have been on the front lines of the pan­dem­ic, with a bonus in this way was a miss-step.”

He adds: “While this may well be exact­ly how the bad guys choose to entice vic­tims, the same aware­ness mes­sage could have been deliv­ered with a less con­tentious choice of bait.”

Oth­ers in the cyber­se­cu­ri­ty indus­try failed to see the issue. “I don’t under­stand why the employ­ees are in a rage about this,” Trend Micro UK tech­ni­cal direc­tor Bharat Mis­try says. “This phish­ing test is a very real­is­tic sce­nario, as cyber­crim­i­nals know that peo­ple are the weak­est link when it comes to cyber defence and will always look to exploit the human psy­che.

“My view is that this exer­cise just goes to show how eas­i­ly peo­ple can be duped despite all the media cov­er­age in recent weeks about cyber attacks”  

Careful wording is key

Although the email may have real­is­ti­cal­ly mim­ic­ked a cyber­crim­i­nal, any busi­ness hop­ing to repli­cate West Mid­lands Trains should be wary of promis­ing bonus­es it has no inten­tion of pay­ing. 

Dis­creet Law con­sul­tant solic­i­tor and employ­ment lawyer Ele­na Coop­er warns that the rail com­pa­ny could be set to “suf­fer a glut of breach of con­tract claims”, depend­ing on the word­ing of its orig­i­nal email.

“There’s a whole argu­ment around con­tracts, offer and accep­tance but, depend­ing on how the email was word­ed, it could be sug­gest­ed the employ­er is for­mal­ly offer­ing a bonus,” she says. “While I don’t think the employ­ees could win a breach of con­tract claim, they could cer­tain­ly argue that a promise has been made and now it is being removed.”

Coop­er claims that it would have been far bet­ter to use a test that “does­n’t actu­al­ly bind the employ­er”. Although a finan­cial incen­tive is often used in phish­ing attacks to per­suade the recip­i­ent to click on a link, she would encour­age employ­ers to check any cyber­se­cu­ri­ty tests with their legal teams first. 

“It could say, ‘Click this link if you want to be con­sid­ered eli­gi­ble for a one-off pay­ment’, but it should nev­er involve the employ­er promis­ing a finan­cial reward,” she adds. “And always bear in mind the detri­men­tal impact any test could have on employ­ee rela­tions.”

How should businesses run phishing tests?

For busi­ness­es look­ing to improve their cyber­se­cu­ri­ty, the most impor­tant ingre­di­ent is trust. 

Tess­ian CEO Tim Sadler, whose IT secu­ri­ty com­pa­ny focus­es on breach­es caused by human error, says: “The fall-out of this exer­cise has enraged and alien­at­ed the com­pa­ny’s employ­ees — the exact oppo­site reac­tion you need to build a robust secu­ri­ty cul­ture and atti­tude with­in an organ­i­sa­tion. 

He believes the exer­cise used by West Mid­lands Trains “exem­pli­fies one of the main prob­lems with secu­ri­ty train­ing today” — treat­ing employ­ees as the prob­lem. “Peo­ple are trained and then blamed when the wrong deci­sion is made and this ulti­mate­ly excludes them from being part of the solu­tion,” Sadler adds.

A busi­ness must be able to rely on its employ­ees to iden­ti­fy and alert the rel­e­vant peo­ple if they believe they’ve fall­en vic­tim to a cyber­se­cu­ri­ty breach. By cre­at­ing tests designed to catch indi­vid­u­als out, it can pre­vent them from report­ing the prob­lem, in case it turns out to be anoth­er hoax.

Cygen­ta co-founder and author of Con­fi­dent Cyber Secu­ri­ty Jes­si­ca Bark­er says: “Cyber crim­i­nals don’t need to wor­ry about build­ing long-term trust, morale and con­fi­dence with their tar­gets but cyber­se­cu­ri­ty pro­fes­sion­als do. 

“Peo­ple will always click links in phish­ing emails, espe­cial­ly if it’s a well-craft­ed phish. A bet­ter test of resilience is to focus on the report rate, rather than the click rate and to address tech­ni­cal defences, for exam­ple net­work seg­men­ta­tion, to stop lat­er­al move­ment of any attacks. Call­ing peo­ple the weak­est link is lazy, it’s a way of try­ing to put the secu­ri­ty bur­den on end-users.”

Any test of cyber­se­cu­ri­ty should look to empow­er indi­vid­u­als to iden­ti­fy the threats, be aware of the con­se­quences and esca­late the issue, Bark­er claims. “The key les­son from this is to put peo­ple first. If you’re think­ing of phish­ing tests as a way of catch­ing peo­ple out, that’s a trick rather than train­ing. 

“A good secu­ri­ty cul­ture builds com­mu­ni­ca­tion between the secu­ri­ty team and the rest of their col­leagues. They have to show they are on their col­leagues’ side, not treat­ing them as if they are the weak­est link.”