Conn. dealership group teaches cyber security

With so many high-profile security breaches at major businesses and organizations in the past year, Christine Pakutka figured the 550 or so employees at Hoffman Auto Group in East Hartford, Conn., would be pretty savvy about phishing emails that try to steal information.

As it turns out, Pakutka, the dealership group's director of business advancement and technology, was about 84 percent correct.

That was revealed in May when Hoffman management sent an email to nearly all employees at its nine dealerships selling Audi, BMW, Ford, Honda, Lexus, Lincoln, Nissan, Porsche and Toyota vehicles. The email, which had Pakutka's usual signature and the Hoffman Group logo at the bottom, asked them to click a link to change their dealership management system passwords in the wake of a possible security breach.

After the email was distributed, Pakutka waited to see what would transpire. "It was both interesting and nerve-wracking — I was a little anxious," she said.

"Many employees came to me and said, 'But the email came from you!' " Pakutka said. "But it definitely raised awareness. Now when they receive something suspicious, they first ask about it. … They're on the lookout and questioning things more, so it's been a positive experience for us."

Online training on Internet fraud prevention is part of such phishing simulations. Talking with employees about how important their role is in cybersecurity is critical to a maintaining security, Kozloski said. But it's also important to keep the tone lighthearted in the aftermath of a test.

"You want it to feel important, but you should also try to have a little fun with it as opposed to being punitive about it because some employees made a mistake," he said.

"But if there are consecutive failures by certain employees and you observe that they're also not doing the monthly online training, that's an employee-performance problem that should be discussed with a manager or someone from human resources."

Phishing exercises also should be staggered so employees don't develop an "it's-the-second-Tuesday-of-the-month-so-this-must-be-a-test" mentality, Kozloski said. And it's fine to do them in fairly quick succession.

On that note, could another test be in the works at Hoffman? Pakutka would neither confirm or deny the possibility, saying, "We want to keep people on their toes."