What is the best way to protect against a phishing attack?

Question

As stated in the title, what can I do on the server (or anywhere else for that matter) to protect against phishing attacks?

Some suggestions I've heard is to tell users that you'll never send them a link to click on. However, our password reset functionality is built around this.

We've also added two factor authentication, but a phishing attack can also easily bypass this through clever scripting that passes the user credentials to our site in real time.

Answer 1

Phishing is a social engineering trick, so the effective way to mitigate it - is to educate your users. Create a mandatory training courses, buy or create a plugin to outlook or whatever mail clients they are using that can flag emails as phishing attacks and send to you or your team for forensics, contract a third party to sometimes perform a non malicious phishing attack (when you click on attachment it will say "this was a part of our comprehensive phishing awareness programs..." to keep your users aware.

Answer 2

Phishing is a multi-faceted problem requiring many layers or response and what layers you choose will depend on your organisation.

Technical side:

• anti-phishing domain defences on ingress email servers to block phishing attempts
• language analysis of email content to identify likely phishing (spam filters)
• 2FA
• password managers that can recognise whitelisted domains before people enter credentials
• banners on emails sent from external domains
• anomaly detection of logins (time, location, patterns)
• convert all HTML emails to plain text
• convert all links sent from external sources to something benign

Human side:

• user education and processes
• a way for people to practice recognising and responding to phishing (simulations)
• a way for people to report phishing emails

Organisational side:

• move away from email as a primary means of internal comms