Phishing

1. Preparation #

• Objective: Reduce what a successful message can achieve, and make reporting one fast, rather than trying to stop every message arriving.
• Scope & scenarios:
  • Bulk credential harvesting through a spoofed sign-in page.
  • Targeted messages against named individuals, particularly those with financial authority or privileged access.
  • Adversary-in-the-middle pages that relay the genuine login in real time and capture the resulting session.
  • Consent phishing, where the user approves an application rather than entering a password.
  • Business email compromise seeking a payment or data change, often with no link or attachment at all.
  • Delivery outside email: chat, SMS, voice calls, and messages from a genuine but compromised partner mailbox.
• The framing that matters most: the click is not the incident. Credential submission, token capture or an approved consent is the incident, and each needs a different response. A reported click with no submission is a near miss worth recording, not an emergency.
• Prerequisites & controls:
  • Phishing-resistant authentication for privileged and high-risk roles, since one-time codes and push approval do not survive a relay attack.
  • Sender authentication published and enforced for the organisation’s own domains, so that impersonation of the brand is harder.
  • Restriction on which applications users may consent to, which closes consent phishing by policy rather than by vigilance.
  • The ability to search and purge a message across all mailboxes in one action. This single capability determines how well the whole playbook performs.
• The reporting channel is a detection control: a one-click report button, a published address, and a culture in which reporting is thanked rather than investigated. Blaming a reporter costs the organisation every future report from that person and everyone they tell.
• Roles & decision makers: SOC analyst and lead, mail administrator, identity administrator, finance for payment-related cases, HR and legal where an individual is implicated, communications for any organisation-wide notice.

2. Identification #