Anti-Phishing Campaign Objective

Question

At every office I have worked, links and files, both internal and external, are shared in emails.

Is the objective of an anti-phishing campaign that users never click on blind, or otherwise unknown, links? pdfs? Any file or link?

What is the expected recipient behavior? What should the average person do?

Answer 1

The objective really depends on what trade-off between efficiency/productivity and security you're willing to make.

Stopping general phising (the mass mail, badly written, generic kind) is't impossible, and can be achieved without too much sacrifice, through proper employee training. Highly targeted, professional grade phising though, is incredibly hard to stop, as it may appear to be from (or be from) legitimate email accounts, be well written and highly relevant to the person receiving it. I would say stopping this kind of attack is near impossible for any organization that relies on interaction with the outside world.

There have been some examples of these attacks recently (against people who most likely do have employee training):

• http://www.canberratimes.com.au/it-pro/security-it/hackers-breach-reserve-bank-20130311-2fv8i.html
• http://www.h-online.com/security/news/item/Highly-specialised-MiniDuke-malware-targets-decision-makers-1813304.html

Of course training employees to exhibit "proper" behavior requires the proper internal organization to support it. There's not much point in telling employees not to do something that will actually be required of them (for example clicking links to change their user details, etc).

The average person can first of all be highly critical of any email received.

• Does the email use properly constructed English?
• Is this email something you asked for or were expecting?
• Would an email purporting to be from paypal or your bank ask you to follow a link to wallyswatersking.com/wp-content/acdasdc.php? Note that links that appear to go to certain places may not (can often be detected by hovering the mouse over the link, or by examining the source code of the email).
• If an email has an attachment, is it from someone you know? If not, it's probably a very bad idea to open it.

Technical solutions to mitigate these problems might include

• Up to date AV (although this will likely not be effective in targeted attacks).
• Application sandboxing.
• Using an email provider that actively works against phishing and spam (like Google or Microsoft).

More on phishing here

• http://www.onguardonline.gov/phishing
• http://www.microsoft.com/security/online-privacy/phishing-symptoms.aspx

Answer 2

In a corporate environment, the goal of a phishing exercises may include any of the following

• Did the user click the suspicious link, if so, why was she/he unable to determine its spoofed - is more user training them required and/or better spam filters or technology
• Did the user report the suspicious email to IT or through other provided methods (the org should be tracking repeated attempts to fine-tune spam filters, see who is targeting them, etc.)
• Did the user open or execute any suspicious files in the email?
• Did the user violate any specific corp policies (e.g., all files are too be transferred via SharePoint, attachments are not be used).
• Did the user forward on the phishing emails to others if directed, and how did those people respond or report (if the email said, "please send to your supervisor for her sign-off")

Basically you want to determine what controls need to be added or enhanced to reduce success of phishing. In addition, if users know there is an anti-phishing test going on or learn about it afterwards, they will be more cautious for some period of time due to fears of being punished or hurting the organization.

Answer 3

You've asked the important question. Aside from analyzing the email for typical phishing markers, if a recipient is unsure, what is the proper behavior?

Employees should have a second line of defense, which could be an 'email review' inbox. Have employees send 'phishy' emails to a central repository where IT staff can review the email from a 3rd party perspective. The benefit of this approach is that it serves as a 'phishing reporting' service, as well.

Employees should be trained to analyze emails, but they should also have some backup to help them when they need it. A simple forward to a '[email protected]' destination is easy to do, easy to train for, and covers phishing reporting and technical review all in one shot.