What Mary Howitt knew about Cybersecurity

“Will you walk into my parlour?” said a spider to a fly;
’Tis the prettiest little parlour that ever you did spy.
The way into my parlour is up a winding stair,
And I have many pretty things to shew when you are there.”

The above is the first four lines of Mary Howitt’s famous poem, The Spider and the Fly, written in 1829 by the English author as a fable to warn of the dangers of falling for something too good to be true. If one cannot find timeless truths as it relates to cybersecurity in this classic work, then I suggest they look harder. Call it an aphorism, adage, or just plain old sayin’, when over 80% of successful cyberattacks have been attributed by multiple sources to phishing emails, victims everywhere are the fly in this poem.

…..Said the cunning spider to the fly, “Dear friend, what shall I do,
To prove the warm affection I’ve always felt for you?
I have, within my pantry, good store of all that’s nice;
I’m sure you’re very welcome — will you please to take a slice?”
“Oh no, no!” said the little fly, “kind sir, that cannot be,”
I’ve heard what’s in your pantry, and I do not wish to see.”

Common sense and/or trained reactions above shows the fly using their emotional intelligence to understand what they are being offered is too good to be true. Most phishing emails are deleted, reported, or blocked by a server as they are too unbelievable to fall for or too insignificant to pay attention to by the reader.

The spider turned him round about, and went into his den,
For well he knew, the silly fly would soon come back again:
So he wove a subtle web, in a little corner, sly,
And set his table ready, to dine upon the fly.

Hackers who attack networks for nefarious purposes do not take days off. Instead, they come at their victims in waves, knowing somewhere within their target there will be a gullible or vulnerable “fly”. It just takes the right verbiage, sense of urgency, or reward in their phishing attempt to get the “fly” to accept the trap as congenial and true.

So he wove a subtle web, in a little corner, sly,
And set his table ready, to dine upon the fly.
Then he went out to his door again, and merrily did sing,
“Come hither, hither, pretty fly, with the pearl and silver wing;
Your robes are green and purple — -there’s a crest upon your head;
Your eyes are like the diamond bright, but mine are dull as lead.”

As hackers fail multiple times to phish individuals, they improve their words, their illusion, and their charade. Eventually, the “fly” will fall into their trap unsuspectedly, leaving the network they are on vulnerable to a multitude of attacks. The end game sounds something like this:

He dragged her up his winding stair, into his dismal den,
Within his little parlour — but she ne’er came out again!

Information Assurance training can be lackluster, inefficient and demotivational. Sometimes analogies, fables, parables, or aphorisms can make the difference between something clicking in the trainee’s brain long enough to be of value or not. If you have authority for input into a Information Assurance program and a limited budget, think creatively about attention and retention tools. The fewer flies in your organization, the better.