Training Beyond Compliance

Erin's Tuesday morning.

Erin works in accounts payable at a university. She's made up, and so is her university, but you've met her. Experienced, careful and busy. She has completed every cybersecurity training the university assigned her, on time.

An email arrives from a supplier she knows, on a thread she started, about an order the university has on file. The supplier changed banks this month. The invoice has the new details. Can she confirm payment today? She checks what she was taught to check. The sender, the thread, the order and the amount all check out. No typos. No odd links.

She pays. Three weeks later the supplier asks where the payment is.

Could she have known?

Then we put the email on screen twice, word for word. In A, the supplier really did change banks. In B, someone else is sitting in the supplier's mailbox. Both happen. Suppliers really do change banks.

Every red flag the room had named was in both copies. They were still there. They had stopped telling her anything. That's what we mean when we say the red flags are gone. The email alone can't tell Erin which one she has, so finding the fake can't be the goal.

The question isn't whether it's fake. It's what Erin does with this kind of request.

The plan.

One person receives the request. Somebody else takes the call. Both know their part before anything arrives.

If you receive it

1. 01

   Stop

   Don't do what the request asks. Not yet.

2. 02

   Call

   Call the person named in your plan, on a number you already have.

3. 03

   Wait

   The request waits until the person you called says go.

If you take the call

1. 01

   Check

   Confirm it on a number you already have. Never through the message.

2. 02

   Decide

   Whoever owns this kind of request says yes or no.

If someone has already clicked, or already sent the money, they call the primary contact on their card right away, and IT hears about it too. Waiting never means waiting to report it. The same goes for a sign-in your phone asks you to approve when you didn't start one. Don't approve it. Call IT right away.

Make it work.

Build the plan for one kind of request. These are the six questions from the worksheet.

• Trigger Which request starts the plan?
• Hold What needs to wait?
• Contact Who would you call? Where would you get their number?
• Authority Who checks it, and who can say go?
• Meanwhile What happens while the request waits?
• Rehearse How do both sides practice it together?

Then try to break it.

1. The person who approves it is out today.
2. The request comes from a real account. That account is compromised.
3. The request is legitimate, and it is urgent.
4. The employee follows your plan. The department they call does not know what to do.

Name a backup, then test it. You wouldn't trust an untested backup of your data.

What you can hand them.

Before a training earlier this year, an older woman asked Adam, "How can I know what's real?" If someone on your campus asked you that tomorrow, hand them a card, not another list of red flags.

• The response card The card from the session. In Stop, write one kind of request that triggers the plan. In Call, the names and trusted numbers of your primary contact and a backup. Wait has nothing to fill in: the request waits until the person you called says go.

It's yours to use, with no form and no email address to leave. Use it on your campus, and change it to fit how your people work. Questions after the session go to contact@cyberweb.services or (844) 448-0644.