And think about how attackers shift their attacks to avoid the latest security thing.
If I am a burglar I try to break into your house. The battle usually goes like this:
Bad guy (BG): Try the door handle. Finds it unlocked, goes in and steals something.
Home Owner (HO). Installs locking door handles.
BG: Tries handle and finds it is locked. Breaks Window, goes in and steals something.
HO: Repairs glass. Installs surveillance system with glass detection sensors.
BG: Gets a ladder and breaks in through second story window.
HO: Puts sensors on all windows and doors. Gets a dog.
BG. Stakes out your house and learns the security code. Brings a pack of meat. Goes in and steals something.
HO: Puts up a sign that their neighbors house doesn't have locks.
If we shift the responsibility to an Artificial Intelligence (AI) method, a motivated attacker will just change their methodology and attack the new thing.
I am attacking the psychology behind the attacks. In our latest phishing test I asked all of the clickers to respond to me on "why" they clicked and it breaks down into roughly 5 psychological areas of attack:
1) Trust - Fooled by a logo or something else they have been taught to trust.
2) Inattentive - Just weren't paying attention
3) Panic - Account lock out, fake charges to their account, a login from Russia, etc.
4) Irresponsible - Mixed personal use with business use
5) Wall of shame - Lying - They lied to me about the reason they clicked. i.e. The dog jumped on my arm while I was just about to delete it. I was about to delete it and I sneezed, etc. They hide behind the "wall of shame" because they don't want to admit that they were fooled.
I can create awareness campaigns around those to reduce our click rate.
I think the C-Suite needs to understand the psychology of the attackers and how they prey on our user's psychological weaknesses and allow us CISO's and Information Security folks to use that knowledge to help protect our environments.
.jpg){kind=link}