"The best security practice is to train the employees..." - Citation, please. That hasn't worked in 30 years. Why do you think it is going to start working nowadays? Have IQ's suddenly risen? When I was a contractor at US Treasury, we took the user out of the loop. Suspicious emails (for a very aggressive definition of "suspicious") were sent to quarantine and not provided to the user. They could not follow a link because the message with the link was not delivered to them. If a user wanted the email message, then we had a procedure to release the message if it was benign.

Also see Peter Gutmann's Engineering Security or Ross Anderson's Security Engineering. The more robust systems anticipate internal threats and bad user decisions, and take users out of the loop. Taking users out of the loop was one of the NSA's remediations after Snowden's release of classified information. NSA reduced the number of sysadmins who had access to the data in the first place.

@jww, training and testing (like trying to scam your own employees to see if they behave as expected) seems a standard practice in several large organizations, and I'm sure I've also seen it mentioned in the best answers on this site. Just googling you can find several security firms providing phishing-related services including training. Of course there are also other security layers to implement (antispam, restrict access, etc) but in the end social engineering is all about a person's behavior. I'm not saying you can always train everybody successfully: somebody might have to moved or fired.

Well, the information you are citing is wrong. The best thing to do is remove the user from the situation. From Engineering Security, p.28: "The best approach to the human-factors problem ... is to redesign ... the application so they [users] are no longer needed. Since users will invariably click ‘OK’ (or whatever’s needed to make the dialog disappear so that they can get on with their job) the best way to protect users is to actually do the right thing, rather than abrogating responsibility to them." Anyone who tells you any different does not have subject matter expertise.

This is why Gutmann's book is so good... the research and citations. It does not get any more explicit than this from p. 203: "In another study that evaluated the effectiveness of trying to educate users about phishing, researchers discovered that the education attempts made no difference in users’ ability to detect phishing email ... [681]". You have to take users out of the loop.

@jww Seems like the solution you are proposing is to airgap the employees.

@reed note that most proponents of security awareness trainings and testings are consultants and others who are selling such services. I've long been arguing against this, but there's money to be made and for that they'll shout you down. That is not to say user awareness isn't something useful. But same as with fire protection, you wouldn't rely on training employees only, right? It's good if they know how to react in case of fire, but your first defenses would be actual fire protection systems.

@jww phishing education has been a focus of intense research and testing since 2014 (when Gutmann's book was published). There are many, many effective ways to teach users how to detect phishing.

@jww What would you suggest for this scenario then, where it seems that they have tried to implement all the standard protections on the non-user side; but the users are still running into issues? How do you completely take employees out of the equation while still leaving them able to function effectively? Obviously if you block every single email, it will remove a threat vector, but cripple productivity. Your advice seems to ignore those practical aspects.

Here's the thing. It doesn't have to be an either/or approach. You can get benefits from both tech solutions and education. Advocating for one doesn't have to mean you're disproving the other. You can "remove the user" in many ways, but technology will always include some human element - there will always be a chance for a human to get duped and screw something up. Education is the only option for dealing with the human element, once you've implemented the appropriate technical solutions. And done correctly, it can certainly be effective.

@Jmac - Well, for this question, I don't think social media exposure matters. When I worked in US Financial employee lists we considered medium value data. The firms did not want other firms poaching [top] employees. (High value data was executive compensation, pending litigation, mergers and acquisitions, etc). Everyone knew everyone else (give or take) so it was not hard to know where the financial wizards were working.

@schroeder - "There are many, many effective ways to teach users how to detect phishing" - Citation, please. The Security UX studies I have read say it is not effective. Most users I know cannot discern the difference between a legitimate email and a fake one, including my mother, my father, my sister-in-law and my brother. In fact, my mother is very social. Every device she owns has been compromised - desktops, tablet and phone. I built here a machine using ARM-based AMD Opteron running Zorin to stop x86 malware and root kits. My biggest problem now is the damn browser malware.

@jww as the developer of the SelfPhish phishing education research platform, author of "Advanced Persistent Training", and contributor to the Security UX lab at the U of Edinburgh, I can't begin to start listing the citations. Bad training sucks. Phishing education is not a knowledge problem but a behavior problem. Training programs that encourage behavior change work very very well, your mother notwithstanding.

@jww I never mentioned social media at all, I'm not sure why you brought that up in the first place. Your point still doesn't address how to mitigate these issues you mention; which is what this answer provides.

@JMac - My bad, I answered in the context of the question; and not the comments. I need to use another block to answer. You don't block all email. Rather, you quarantine suspicious emails and then notify the user. That means you need a security appliance at your email gateways. Users don't make the choice of "what is suspicious". Most users don't claim the quarantined email so no time is lost.

@JMac - For those who do request a release, the NOC or SOC personnel extracts the suspicious email at a mini-DMZ area on the network using a computer like ARM64 or PowerPC (back then it was PowerPC or SPARC). The email and attachments are inspected and scanned. This takes the "dumb user" out of the decision process. Some PDFs and Word docs are re-saved/re-written to remove active content like macros. The email is released if we can't find a reason to reject the email. On a typical 8-hour shift at Treasury, we would get less than 10 requests to release emails from a base of about 18,000 users.

@jww No quarantine will be perfect. Either you block useful emails and hamper productivity, or you don't block enough emails and still leave your users susceptible to phishing-type attacks. At some point, users will be involved and proper using training cannot be avoided. There are also obviously costs associated with setting up a system like you describe, and although the economics make sense for a 18,000 user system of vital information; it might not make any economic sense to have such a system for a small company with information that would be less consequential if leaked.

@JMac - "No quarantine will be perfect" - Agreed. The quarantine was not perfect. It mis-classified at a rate of at least [roughly] 10 a day. "There are also obviously costs..." - So what? Security is a cost center. It is the cost of doing business. Computing is a privilege, not a right. If you want to collect the data, then you have to protect the data.

@jww And depending on the data collected and the size of your company, using the methods you describe to protect the data could cost more than the data is even worth. You're describing a system that has to be highly reliable and secure. The costs to implement and maintain such a system could be magnitudes larger than a small company can afford to invest in security, especially depending on what is being secured. It seems reasonable to me that it can be far more cost effective to train your users to be a part of the security system, especially if there is room for mistakes.

@JMac - Train users to do what? Anyone who places their hopes on the user doing the right thing has already lost. Some users don't have the skills to make a security related decision, and some users will ignore the training even after you teach them. Users will choose the dancing bunnies around 40% of the time even after you train them not to open emails or follow links. We know this is a fact from Security UX studies.

@jww Some users. The point is often to minimize potential damage instead of stopping it entirely, because the latter costs far more. The fact that the training may not be effective for all users isn't the same as saying the training has no benefits or isn't good practice. It's not the most robust system; but the most robust system is not necessarily the best business decision.

@JMac - Maybe this will make more sense... My undergrad and graduate work was in Computer Science. I'm guessing you are about the same. We are CompSci guys. Could the company send us to 2 hours of training and then expect us to do the work of the MBAs and CPAs in the front office? I certainly should not be modifying the ledger or trying to balance to books.

@jww I actually studied mechanical engineering, and work for a contractor. I took a training course like this, and it took about an hour at most. I still use a computer daily for work, and thus am (I would say reasonably) expected to be able to properly use a computer without falling for obvious security breaches. I'm not expected to do the work of IT specialists; but I am expected to be reasonably competent with the tools I use daily. Phishing training was a part of the competence my company wanted me to develop. Seems perfectly fair to me if my job involves computers.

Wait a minute... You are not using research results or security engineering principals??? You are saying, my company does it, it worked for me so it is OK??? Man, what a waste of my time... If you wanted announce you are proficient at it, you should have done so instead of dragging me into this.

@jww I'm wondering why you think it wouldn't be best practice to educate your employees using the technology on the risks associated with them. That's standard across many industries, not just computers. The sources you are citing seem to be coming from the assumption you can remove all user input, which again, is just not feasible in practice for most industries.