What do you think about a 3-strikes rule for clicking malicious links? Is that taking risk reduction too far?
Sort by:
We require additional phishing specific training for repeat offenders. We're also considering notifying HR.
Security awareness training should be positive and if you have habitual "clickers" they need focused attention to help them strengthen their security prowess. Also, habitual "clickers" can be added to further security control with sandboxing, RBI and other zero trust technologies.
We did not have a three strike or nine strike or any other strike rule
However every single policy and rule we had for any topic, IT, HR, Financial, Travel had the phrase.
“Any employee violating this policy is subject to disciplinary action up to and including termination “
I don’t know of anyone being terminated for clicking on a malicious link, but they may have been encouraged to go work somewhere else
3 strikes? Babe Ruth struck out 1,330 times in his career.
It may be unfair to penalize an end-user for that, as there are a lot of other factors.
One could also turn the tables and point at information security. Why do they have systems that allow malicious links to enter the system in the first place?
Overall, it is a bad idea.
Others have already highlighted my exact thoughts, why would your security device let so many phishing attempts through and additional training should be recommended. Given the majority of phishing utilities and the amount of information being delivered now on a daily basis the 3 strike rule is too harsh.