Ramping Up Your Phishing Program
Many organizations have recently started phishing programs as part of their overall awareness program. Lockheed Martin has been running intensive phishing assessments for 5+ years utilizing a rigorous, repeatable methodology. In addition to greatly reducing the risk associated of employees taking a \bad" action with suspicious e-mails they have identified numerous lessons learned on how to effectively use phishing to manage cyber security risk presented by human behavior. Examples include: how to structure a good phishing email, how to build a progressive and diverse training program, addressing chronic "clickers" and developing metrics that help inform risk management strategies and articulate risk reduction results to relevant stakeholders.
