11–14 of 14 posts
Do you mean employees? Or customers? Or some other group?
I meant for developers or business owners who are developing a web application. If there is any way for them to enable extra security for their application.
Hardware keys
We'd have to extend this with the concept of a multi-sig wallet to unlock processes or transactions
Quarterly interactive testing is the only thing I have seen work. A common method is using Proofpoint + Fake realistic looking sites and emails. Get stats on how many click the links and how many put in corporate credentials. Proofpoint can do this or a company could make their own tracking stats. Without embarrassing or punishing them ensure the ones that put in credentials get trained. The credentials should automa…
I'm not sure if it's configuration-dependent, but the emails should be realistic and reflect the tools/services your org uses. Sending them Zoom-branded emails foe example while the org has never used Zoom is pretty pointless. The ones I've experienced unfortunately can be spotted from a mile away due to how low-effort they were (something an actual targeted attack will never do - a targeted attack email would look perfect with the exception of the factors they can't fake such as the "From" address).
> Without embarrassing or punishing them
At the end of the day, the objective is that they don't engage with suspicious e-mails - whether they do that out of concern for security or out of fear of embarrassment/losing their paycheck is irrelevant.
You want people to be afraid to fall for an attack. The fear should be about negative consequences to the organization and the general unpleasantness that comes out of it, but fear of embarrassment works too.
Passkey/webauthn
I'd recommend Yubikeys (or actual smartcards even, if hardware constraints allow) used in PIV mode with a client certificate authing to an internal SAML/OIDC provider which seamlessly bridges to third-party apps.
This is immune to phishing because there's literally nothing to phish, beyond maybe the PIN but it's pretty pointless as it would still require the Yubikey/smartcard to be of any use. When done well, it's also a great UX because nobody ever sees an actual login screen. Unlocked smartcard present = you are logged in everywhere.