Topics in this domain
- The Security Program: Charter, Scope and Objectives
- Security Team Structure, Roles and Staffing
- Working with Legal, HR, IT, Audit and the Business
- Program Implementation: From Plan to Operating Controls
- Information Asset Identification and Valuation
- Data Classification: Owners, Custodians and Users
- Data Lifecycle: Retention, Archiving and Secure Disposal
- Enterprise Architecture for Security Managers
- Information Security Architecture: Principles and SABSA
- Defence in Depth and Zero Trust
- Cloud Security and Shared Responsibility
- Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
- Security Policy Development and Lifecycle
- Security Standards and Baseline Requirements
- Procedures, Guidelines and Acceptable Use
- Policy Enforcement, Exceptions and Review
- Designing Security Metrics: KPIs, KRIs and KCIs
- Collecting, Analysing and Reporting Metrics
- Security Maturity Models and Program Assessment
- Control Types and Categories
- Control Design and Selection Based on Risk and Cost
- Control Testing: Design vs Operating Effectiveness
- Identity and Access Management
- Network and Endpoint Security Controls
- Application Security and the Secure SDLC
- Configuration, Change and Patch Management
- Cryptography for Security Managers
- Security Testing: Scanning, Pen Testing and Tracking Remediation
- Security Awareness Program Design
- Role-Based Security Training
- Phishing Simulations and Social Engineering Defences
- Third-Party Risk Management and Due Diligence
- Vendor Contracts, SLAs and Right to Audit
- Fourth-Party and Supply Chain Risk
- Outsourcing and Managed Security Services
- Security Stakeholder Communication
- Executive Dashboards and Board Reporting
- Continuous Improvement of the Security Program
Phishing Simulations and Social Engineering Defences
Hacking the human
Social engineering exploits human nature rather than technical flaws: authority (“this is the CEO”), urgency (“do it now”), trust (“your usual supplier”), helpfulness, fear and curiosity. Phishing, smishing (SMS), vishing (voice), pretexting, business email compromise and, increasingly, deepfake audio and video all use these levers.
Running simulations well
- Agree the rules with HR, legal and, where relevant, works councils. No public shaming.
- Baseline: the first campaign shows the starting point.
- Run campaigns: realistic, varied, with increasing difficulty.
- Teach in the moment: a short lesson immediately after a click is the most effective learning.
- Measure and adapt: track report rate and click rate; give repeat clickers extra support.
Persistent, deliberate disregard of policy goes through the normal disciplinary process, but that’s rare.
Click rate vs report rate
- Click rate shows how many fell for it. It varies with difficulty and can be gamed with easy tests.
- Report rate shows how many told security, which is the sign of a working early-warning culture.
- Time to first report shows how quickly the SOC hears about a real campaign.
- Repeat clickers get extra coaching, not humiliation.
Layered defences
Awareness alone isn’t enough. Layer it:
| Layer | Controls |
|---|---|
| Technical | Email filtering and sandboxing; DMARC, SPF and DKIM against spoofing; phishing-resistant MFA |
| Process | Call-back on numbers already on file; dual approval for payments and bank-detail changes |
| People | Awareness, simulations, easy reporting |
Example. An accounts clerk gets an urgent email from a known supplier’s real (hacked) mailbox asking to change bank details. Training made her suspicious, but the process stopped it: bank changes require a call-back to the number already on file, and the supplier confirms it’s fraud.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Main purpose of phishing simulations | Measure and improve user behaviour |
| Best indicator of a healthy reporting culture | A rising report rate and faster reports |
| Best control against business email compromise | Independent verification and dual approval |
| Most effective control against social engineering | Awareness, backed by technical and process controls |
| Simulation results are used to shame staff | Wrong; it undermines reporting |
In short
- Social engineering exploits trust, authority, urgency, fear, helpfulness and curiosity rather than technical flaws.
- Phishing simulations measure and improve how people respond; the report rate matters more than the click rate.
- Run simulations with agreed rules (HR, legal), realistic content, immediate teaching and no public shaming.
- Awareness is backed by technical controls (email filtering, DMARC, phishing-resistant MFA) and process controls (call-back verification, dual approval).
- Business email compromise and deepfake impersonation are best stopped by verification procedures, not training alone.
- Repeat clickers get extra support; persistent deliberate disregard goes through the normal disciplinary process.
Exam traps
- Click rate alone is a misleading measure; report rate and speed show a healthy culture.
- Simulations used to punish people destroy trust and reporting.
- Calling the number in a suspicious email isn't independent verification.
- Training can't be the only defence; layer technical and process controls.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Hacking the human
Running simulations well
1 / 8