Why I Changed My Mind about Federal User Cyber Training

I’ve never been a big fan of the mandatory cybersecurity training that I have received at my workplaces over the years. Besides thinking that I could have taught most of those classes, my biggest problem with that training was that they were rarely interactive and always boring. Most of the time they involved watching lengthy videos explaining basic cybersecurity concepts. Honestly, I almost enjoyed the sexual harassment training a lot more, and that is saying something. I seriously doubt that the cyber training did anything to make the workplace safer. 

Quite a few years ago I was working on a story about federal agencies that were experimenting with different training programs, and things didn’t seem to be going too well for them either. At one agency, a frustrated information technology worker told me that training users seemed like an impossible task. He told me a story about how he tried to pad his numbers to justify more training. 

To accomplish this, he warned users that a phishing email would be delivered to them at exactly 2:45 p.m. that afternoon. The proper response was not to click on any of the links. His plan was to show that users were learning how to spot phishing scams to prove that his training efforts were really working. He even sent out a personal email about an hour before the test to remind people not to click on any links in the phishing email that was due to be sent in just a few minutes.

The final result was surprising. Even with all the warnings, by the end of the day, 35% of the users had clicked on the fake phishing scam. Half of them did so within a couple minutes of it landing in their inbox. Although I never included this final tidbit in my article, he later told me that “users are stupid,” a fairly common sentiment among IT professionals.

It almost seems like the federal government agrees. Training has been deemphasized over the years, replaced with layers of email security platforms designed to protect users from ever having to decide whether or not to click on suspicious links or emails. 

The National Institute of Standards and Technology Special Publication 800-177, Trustworthy Email, recommends having layered protection on all email systems including Sender Policy Framework (SPF), Domain Keys Identified Mail (DKIM), and Domain-based Message Authentication Reporting and Conformance (DMARC). This is in addition to whatever gateways, firewalls and mail scanners are also in place. In fact, the publication specifically states that “email communications cannot be made trustworthy with a single package or application.”

Having multiple protections on email is fine, but that alone won’t fully protect users. Even the best mail security programs and appliances I’ve ever tested were only about 99% accurate, and those were the cream of the crop. Nextgov reported that just at the Defense Department alone, they were stopping 36 million emails with malware, viruses and phishing schemes every single day. But what is getting through? If only 1% of those threats are running the gauntlet, that’s 180,000 bad emails getting delivered each day. Even factoring in layered protection, some threats are going to get through using a communications medium like email that is designed to be open to the outside world.

And in an ironic little twist, users at highly protected organizations like Defense might come to rely on those protections. They aren’t getting asked to buy Cialis or CBD gummies every day, so when a legitimate-looking phishing email comes in that looks like it was sent by a superior, they may be more likely to trust it without too much scrutiny.

Which brings us back to training. At the end of the day, it still comes down to a user not clicking on something malicious. Recently I had a chance to review a modern cybersecurity training platform for CSO Magazine. The full review is scheduled to run in November, but I can already say that it really changed my mind about training. It turns out that users weren’t stupid after all, but the training programs used to improve their cybersecurity awareness certainly were.

The specific program I reviewed was called CybeReady, which is one example of the new breed of training platforms. CybeReady automates training, letting administrators set up months of exercises for users in just a few minutes. Thereafter, the platform will automatically graduate some users to higher-proficiency groups based on their performance, perhaps sending them fewer test emails or even harder ones with advanced phishing techniques. Users on the other end of the spectrum, those who are falling for constant phishing emails, are given more training or easier tests until they improve.

Training with CybeReady happens the instant a user makes a mistake. If they get a phishing test email and click on one of the links, they are taken to a page that explains that, had this been a real threat, they would be infected at this point and both their agency and their personal information would be at risk. They are shown four bullet points that explain how exactly they could have spotted the deception in the mail that tricked them. By providing instant training as soon as they stumble, CybeReady gets their instant and undivided attention for a very brief window when the learning process is the most valuable. 

At the end of each campaign, administrators are shown the growth of their users’ cybersecurity skills, as well as areas where people still need to improve, which is helpful for setting up future training. I wonder what that frustrated federal IT worker would have said if he had something like CybeReady back in the days of all those dull training films.

Users aren’t stupid. If properly trained, they can become an agency’s last and best line of defense, able to outsmart even the most clever phishing and social engineering attacks. A smart, well-versed and trained human can regularly reach a 100% success rate against attacks that target them or their agency. And that is something that no program, no matter how advanced, could ever achieve. 

John Breeden II is an award-winning journalist and reviewer with over 20 years of experience covering technology. He is the CEO of the Tech Writers Bureau, a group that creates technological thought leadership content for organizations of all sizes. Twitter: @LabGuys