Prioritizing Security Spending After Repeated Phishing Losses
A 400-person insurance brokerage suffered two phishing-related account takeovers in six months. The last incident led to a fraudulent wire of $180,000; $120,000 was recovered. The CISO has $150,000 for the next year. Options: (A) organization-wide phishing simulation and training, $60,000, expected to cut click rate from 18% to 9%; (B) multifactor authentication for all remote access and email, $90,000, blocks most credential-based takeovers; (C) endpoint detection and response, $120,000, detects lateral movement; (D) accept a $40,000 cyber-insurance premium increase if controls are not improved. Leadership wants a decision within two weeks. The firm has no dedicated security operations center and outsources monitoring.
1. Recommend a portfolio of controls and justify it using likelihood, impact, and feasibility rather than cost alone.
Read the worked answer
The dominant loss pattern is credential theft leading to fraudulent payments. MFA (B) directly interrupts that chain and addresses the highest-likelihood, highest-impact event; it should be funded first. Training and simulation (A) reduce the probability of successful phishing but do not block a stolen session or credential, so it is complementary rather than sufficient.
With a $150,000 budget, the defensible portfolio is B + A = $150,000. EDR (C) is valuable for detecting lateral movement, but at $120,000 it consumes most of the budget and the firm has no internal SOC able to act on alerts; outsourced monitoring may add cost. Insurance (D) transfers residual loss but does not reduce incident frequency.
Judgment: fund MFA first, then training; defer EDR until a monitored detection use case and response capability are funded. Revisit EDR if a post-implementation review shows credential attacks are blocked but lateral movement remains unobserved.
2. Identify the residual risks that remain after implementing MFA and training, and propose compensating controls.
Read the worked answer
Residual risks include MFA fatigue or push bombing, real-time phishing proxies that capture session tokens, business email compromise from a compromised trusted vendor, insider misuse, and help-desk social engineering that resets MFA. Training reduces but does not eliminate click risk.
Compensating controls:
- Out-of-band verification for wire transfers and changes to vendor banking details, with dual approval and callbacks to a known number.
- Conditional access, impossible-travel and risk-based sign-in rules, and number matching or phishing-resistant authentication for high-risk roles.
- DMARC enforcement and external-sender banners to reduce spoofing.
- Least privilege and periodic access reviews for finance and claims systems.
- A tested incident-response playbook with a defined time to revoke sessions and reset credentials.
3. Which metrics should be reported to the board after implementation?
Read the worked answer
Report a small set of outcome and coverage metrics, not activity counts alone:
- MFA coverage: percentage of users and critical applications enforced, with exceptions listed.
- Phishing simulation click rate and report rate, trended over time and segmented by department.
- Mean time to revoke a compromised session and mean time to contain a reported incident.
- Number of attempted fraudulent payment requests and amount blocked by callback verification.
- Control exceptions and repeat findings from access reviews.
- Residual risk statement: known gaps, such as applications not yet MFA-enabled, and the plan and date to close them. The board should see whether the loss trend is falling, not merely whether training was delivered.