Fighting Phishing

Introduction xiii Part I Introduction to Social Engineering Security 1 Chapter 1 Introduction to Social Engineering and Phishing 3 What Are Social Engineering and Phishing? 3 How Prevalent Are Social Engineering and Phishing? 8 Chapter 2 Phishing Terminology and Examples 23 Social Engineering 23 Phish 24 Well- Known Brands 25 Top Phishing Subjects 26 Stressor Statements 27 Malicious Downloads 30 Malware 31 Bots 31 Downloader 32 Account Takeover 32 Spam 33 Spear Phishing 34 Whaling 35 Page Hijacking 35 SEO Pharming 36 Calendar Phishing 38 Social Media Phishing 40 Romance Scams 41 Vishing 44 Pretexting 46 Open- Source Intelligence 47 Callback Phishing 47 Smishing 49 Business Email Compromise 51 Sextortion 53 Browser Attacks 53 Baiting 56 QR Phishing 56 Phishing Tools and Kits 57 Summary 59 Chapter 3 3x3 Cybersecurity Control Pillars 61 The Challenge of Cybersecurity 61 Compliance 62 Risk Management 65 Defense-In-Depth 68 3x3 Cybersecurity Control Pillars 70 Summary 72 Part II Policies 73 Chapter 4 Acceptable Use and General Cybersecurity Policies 75 Acceptable Use Policy (AUP) 75 General Cybersecurity Policy 79 Summary 88 Chapter 5 Anti-Phishing Policies 89 The Importance of Anti-Phishing Policies 89 What to Include 90 Summary 109 Chapter 6 Creating a Corporate SAT Policy 111 Getting Started with Your SAT Policy 112 Necessary SAT Policy Components 112 Example of Security Awareness Training Corporate Policy 128 Acme Security Awareness Training Policy: Version 2.1 128 Summary 142 Part III Technical Defenses 145 Chapter 7 DMARC, SPF, and DKIM 147 The Core Concepts 147 A US and Global Standard 149 Email Addresses 151 Sender Policy Framework (SPF) 159 Domain Keys Identified Mail (DKIM) 165 Domain- based Message Authentication, Reporting, and Conformance (DMARC) 169 Configuring DMARC, SPF, and DKIM 174 Putting It All Together 175 DMARC Configuration Checking 176 How to Verify DMARC Checks 177 How to Use DMARC 179 What DMARC Doesn’t Do 180 Other DMARC Resources 181 Summary 182 Chapter 8 Network and Server Defenses 185 Defining Network 186 Network Isolation 187 Network-Level Phishing Attacks 187 Network- and Server-Level Defenses 190 Summary 214 Chapter 9 Endpoint Defenses 217 Focusing on Endpoints 217 Anti- Spam and Anti- Phishing Filters 218 Anti- Malware 218 Patch Management 218 Browser Settings 219 Browser Notifications 223 Email Client Settings 225 Firewalls 227 Phishing- Resistant MFA 227 Password Managers 228 VPNs 230 Prevent Unauthorized External Domain Collaboration 231 DMARC 231 End Users Should Not Be Logged on as Admin 232 Change and Configuration Management 232 Mobile Device Management 233 Summary 233 Chapter 10 Advanced Defenses 235 AI- Based Content Filters 235 Single-Sign-Ons 237 Application Control Programs 237 Red/Green Defenses 238 Email Server Checks 242 Proactive Doppelganger Searches 243 Honeypots and Canaries 244 Highlight New Email Addresses 246 Fighting USB Attacks 247 Phone- Based Testing 249 Physical Penetration Testing 249 Summary 250 Part IV Creating a Great Security Awareness Program 251 Chapter 11 Security Awareness Training Overview 253 What Is Security Awareness Training? 253 Goals of SAT 256 Senior Management Sponsorship 260 Absolutely Use Simulated Phishing Tests 260 Different Types of Training 261 Compliance 274 Localization 274 SAT Rhythm of the Business 275 Reporting/Results 277 Checklist 277 Summary 278 Chapter 12 How to Do Training Right 279 Designing an Effective Security Awareness Training Program 280 Building/Selecting and Reviewing Training Content 295 Additional References 303 Summary 304 Chapter 13 Recognizing Rogue URLs 305 How to Read a URL 305 Most Important URL Information 313 Rogue URL Tricks 315 Summary 334 Chapter 14 Fighting Spear Phishing 335 Background 335 Spear Phishing Examples 337 How to Defend Against Spear Phishing 345 Summary 347 Chapter 15 Forensically Examining Emails 349 Why Investigate? 349 Why You Should Not Investigate 350 How to Investigate 351 Examining Emails 352 Clicking on Links and Running Malware 373 Submit Links and File Attachments to AV 374 The Preponderance of Evidence 375 A Real- World Forensic Investigation Example 376 Summary 378 Chapter 16 Miscellaneous Hints and Tricks 379 First- Time Firing Offense 379 Text- Only Email 381 Memory Issues 382 SAT Counselor 383 Annual SAT User Conference 384 Voice- Call Tests 385 Credential Searches 385 Dark Web Searches 386 Social Engineering Penetration Tests 386 Ransomware Recovery 387 Patch, Patch, Patch 387 CISA Cybersecurity Awareness Program 388 Passkeys 388 Avoid Controversial Simulated Phishing Subjects 389 Practice and Teach Mindfulness 392 Must Have Mindfulness Reading 393 Summary 393 Chapter 17 Improving Your Security Culture 395 What Is a Security Culture? 396 Seven Dimensions of a Security Culture 397 Improving Security Culture 401 Other Resources 404 Summary 404 Conclusion 405 Acknowledgments 407 About the Author 411 Index 413