PHISHING

Phishing is a form of social engineering in which a cyber threat actor poses as a trustworthy colleague, acquaintance, or organization to lure a victim into providing sensitive information or network access. The lures can come in the form of an email, text message, or even a phone call. If successful, this technique could enable threat actors to gain initial access to a network and affect the targeted organization and related third parties. The result can be a data breach, data or service loss, identity fraud, malware infection, or ransomware.

Phishing susceptibility is the likelihood of an individual becoming a victim of a phishing attempt. High susceptibility increases the likelihood that cyber threat actors can exploit their target.

Don't be a victim! You can prevent phishing success and limit its negative impacts, should initial access occur. Here's how this adversarial technique works:

1..SELECT THE BAIT

Threat actors pose as colleagues, acquaintances, or reputable organizations and solicit sensitive information or lure victims into downloading and executing malware. Bait typically consist of an email with a subject line that entices the user into opening the email, e.g., the subject line contains an alert, an action, or request for information. CISA Phishing Campaign Assessments revealed these most successful subject lines:

• Financial security alerts and updates
• Organization-wide announcements and updates
• User-specific alerts, such as training updates

2..SET THE HOOK

A single bite can lead to successful exploitation. Threat actors set multiple hooks to increase their chance of success and then wait for a victim to take the bait.

3..REEL IN THE CATCH OF THE DAY

The threat actor reels in the catch of the day when an email is not blocked by network border or endpoint protections and reaches a victim who replies with valuable information or executes a spoofed link or attachment. The threat actor can then feast on sensitive information, credentials, or the ability to compromise the endpoint via malware disguised as links and attachments.

4..ACTIONS TO HELP PREVENT BEING HOOKED IN A PHISHING ATTACK

BLOCK THE BAIT

• Implement strong network border protections — as an initial barrier to reduce the opportunity for a successful phishing attempt to further its damage.
• Configure email servers to utilize protocols designed to verify the legitimacy of email communications, like Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-Based Message Authentication, Reporting, and Conformance (DMARC).
• Incorporate denylists or cyber threat intelligence feeds into firewall rules to block known malicious domains, URLs, and IP addresses.

DON’T TAKE THE BAIT

• Educate employees to recognize common indicators of phishing, such as suspicious sender email addresses, generic greetings, spoofed hyperlinks, spelling or layout errors, and suspicious attachments.
• Teach employees to keep their guard up on all communications platforms, including social media, and flag suspicious correspondence for security review.

REPORT THE HOOK!

• Educate employees on what to do when they receive a phishing email—regardless of whether they fell for it:

Report the email to the appropriate security teams.

Do not forward the malicious email to others within the organization.

• When employees report malicious communications, incident responders analyze the threat in the hopes of preventing the threat actor from widening the intrusion:

Incident responders can determine if the attack was an isolated incident or if it is an attack across the organization.

Incident responders can identify indicators to implement within the security protection mechanism to prevent the attack from impacting the entire organization.

PROTECT THE WATERS

After obtaining initial access via a successful phishing attempt, threat actors will often try to take control of its victim’s account or devices to move laterally within the organization’s network. To protect the network:

• Enforce phishing-resistant multifactor authentication to secure resources and protect from lateral movement.
• Review and reduce the number of accounts with access to critical data and devices.
• Restrict administrative password sharing and re-use and remove non-essential elevated privileges from users to reduce opportunities for privilege escalation.
• Add protection at the endpoint as the last line of defense between the user and a threat actor’s attack.
• Automate mandatory security updates for browsers, applications, software, and antivirus on all internet-accessible end user devices.
• Implement software restriction policies to allow only software necessary for business purposes on end user devices.
• Implement an endpoint detection and response (EDR) solution to further monitor for and block malicious activity on end user devices.

Source: CISA