Design an awareness programme and a phishing campaign you could defend to HR

applied · 80 min · Objective 5.6

Task

Design an awareness programme end to end: the training mix and how each part is delivered, a phishing simulation with its pretexts and control group, the metrics, the no-blame communication, and the reports managers receive. This lesson has no short lab because the real exercise needs colleagues who consented to be measured, and a campaign run against yourself proves nothing about behaviour. Designing it is the part a candidate is actually asked to get right.

Steps

Write /tmp/campaign.md starting with the objective, stated as a behaviour rather than a score: what you want people to DO differently in six months.
Set out the training mix: what onboarding covers, how ongoing training is spread through the year, which roles get targeted training and against which attack (finance and business email compromise, the help desk and reset requests), and what corrective training looks like. For each, name the delivery: LMS, self-service portal, one-to-one or one-to-many.
Define the metrics and put report rate first: report rate, time to first report, click rate, credential submission rate. Say which one you would take to the board and why it is not the click rate.
Design three pretexts of increasing difficulty, and write the ones you are RULING OUT with the reason: fake bonuses, fake redundancies, fake disciplinary notices. Cruel pretexts produce distress, lasting mistrust of the security team, and an HR problem.
Design the control group: who does not receive the simulation, so you can tell whether a change in behaviour came from your programme or from something else.
Write the no-blame communication: what is said before the programme starts, what happens when somebody clicks, and what explicitly does NOT happen. Then write the escalation path for somebody who clicks repeatedly, which is a support conversation rather than a punishment.
Design the managerial report each manager receives (their team's trends and outstanding training, not a list of names), and say how any behaviour risk score would be used to direct support rather than discipline.
Finally, write the consent and communication position you would take to HR and to the works council or staff representatives, and what data you would and would not retain about individuals.

Verify

python3 - <<'PY'
import re
t=open('/tmp/campaign.md').read().lower()
need={'report rate first':'report rate',
      'time to report':'time to (first )?report',
      'targeted training':'targeted',
      'corrective training':'corrective',
      'delivery method':'lms|self-service|one-to-one|one-to-many',
      'control group':'control group',
      'ruled-out pretexts':'rul(e|ing) out|would not use|excluded pretext',
      'no-blame':'no.blame|not be punished|no punishment',
      'repeat clicker path':'repeat|again|support conversation',
      'managerial report':'manager',
      'consent/hr':r'consent|\bhr\b|works council|staff rep',
      'data retention':'retain|retention|individual data'}
missing=[k for k,p in need.items() if not re.search(p,t)]
print('elements present:',len(need)-len(missing),'of',len(need))
assert not missing, 'missing: '+', '.join(missing)
i_rep=t.find('report rate'); i_click=t.find('click rate')
assert i_rep>=0 and (i_click<0 or i_rep<i_click), \
    'click rate is presented before report rate - the programme is optimising the wrong number'
print('report rate leads the metrics')
PY
grep -ciE "six months|behaviour|do differently" /tmp/campaign.md

The ordering assertion is deliberate and is the lab's central claim: report rate must appear before click rate in your own document. A programme that leads with click rate optimises for people not clicking, which is achieved by sending easier simulations; a programme that leads with report rate builds a detection capability out of the workforce.

Notes

The ruled-out pretexts and the HR position are what make this defensible. Every organisation that has run a fake-bonus simulation has learned the same lesson publicly, and the damage is not to the campaign: it is to the security team's standing, which is the thing the whole programme depends on.

This is an independent study companion for CompTIA Security+ SY0-801 and is not produced by or endorsed by CompTIA.