Fighting Phishing: Everything You Can Do to Fight Social Engineering and Phishing

Cover
Title Page
Copyright Page
Contents
Introduction
	Who This Book Is For
	What Is Covered in This Book
	How to Contact Wiley or the Author
Part I Introduction to Social Engineering Security
	Chapter 1 Introduction to Social Engineering and Phishing
		What Are Social Engineering and Phishing?
		How Prevalent Are Social Engineering and Phishing?
			Social Engineering Statistics
		The Solution
		Summary
	Chapter 2 Phishing Terminology and Examples
		Social Engineering
		Phish
		Well-Known Brands
		Top Phishing Subjects
		Stressor Statements
		Malicious Downloads
		Malware
		Bots
		Downloader
		Account Takeover
		Spam
		Spear Phishing
		Whaling
		Page Hijacking
		SEO Pharming
		Calendar Phishing
		Social Media Phishing
		Romance Scams
		Vishing
		Pretexting
		Open-Source Intelligence
		Callback Phishing
		Smishing
		Business Email Compromise
		Sextortion
		Browser Attacks
		Baiting
		QR Phishing
		Phishing Tools and Kits
		Summary
	Chapter 3 3x3 Cybersecurity Control Pillars
		The Challenge of Cybersecurity
		Compliance
		Risk Management
			Assessing Risk Probability
		Defense-In-Depth
		3x3 Cybersecurity Control Pillars
		Summary
Part II Policies
	Chapter 4 Acceptable Use and General Cybersecurity Policies
		Acceptable Use Policy (AUP)
		General Cybersecurity Policy
			Recommended Best Security Practices
		Summary
	Chapter 5 Anti-Phishing Policies
		The Importance of Anti-Phishing Policies
		What to Include
			Introduction
			Definitions
			Training
			Recognizing Common Signs of Social Engineering
			Reporting
			What to Do in the Event of Successful Phishing
			Incident Response
			Anti-BEC policies
			Employee Monitoring
		Summary
	Chapter 6 Creating a Corporate SAT Policy
		Getting Started with Your SAT Policy
		Necessary SAT Policy Components
			Policy Header Information
			Goal
			Control Mapping
			Get Senior Management Approval and Sponsorship
			Determine Where the SAT Program Originates
			Scope
			Definitions
			Use Mostly Internal or External SAT Resources
			Training Specifics
			Simulated Phishing Campaigns
			Platform Types
			Content Types
			Will You Have a Champions Program?
			Expected Participant Behavior
			Rewards and Consequences
			Incident Response
			Which Metrics to Use
			SAT Policy Component Conclusion
		Example of Security Awareness Training Corporate Policy
		Acme Security Awareness Training Policy: Version 2.1
			Scope
			Policy Goal
			Control Mapping
			Definitions
			Security Awareness Training Program Summary
			Simulated Phishing Campaigns
			Participant Requirements
			Acme Champion Program
			Rewards and Consequences
			Incident Response
			Reporting Metrics
		Summary
Part III Technical Defenses
	Chapter 7 DMARC, SPF, and DKIM
		The Core Concepts
		A US and Global Standard
		Email Addresses
			Friendly From Name
			5322.From Name
			5321.MailFrom Email Address
			HELO Email Domain
		Sender Policy Framework (SPF)
		Domain Keys Identified Mail (DKIM)
		Domain-based Message Authentication, Reporting, and Conformance (DMARC)
			DMARC Failed Email Treatment
			DMARC Reporting
		Configuring DMARC, SPF, and DKIM
		Putting It All Together
		DMARC Configuration Checking
		How to Verify DMARC Checks
		How to Use DMARC
		What DMARC Doesn’t Do
		Other DMARC Resources
		Summary
	Chapter 8 Network and Server Defenses
		Defining Network
		Network Isolation
		Network-Level Phishing Attacks
		Network- and Server-Level Defenses
			Firewall
			Use Phishing-Resistant MFA
			HTTPS
			Content-Filtering
			Anti-Phishing Filters
			Anti-Malware
			Email Gateways
			Email Servers/Service
			Email Search and Destroy
			Block Potentially Malicious File Attachments
			Detonation Sandboxes
			Anti-Domain Spoofing
			Blocklists
			Greylists
			Reputation Services
			DNS Lookups
			Network Flow
			Country-Blocks
			Picture Badges
		Summary
	Chapter 9 Endpoint Defenses
		Focusing on Endpoints
		Anti-Spam and Anti-Phishing Filters
		Anti-Malware
		Patch Management
		Browser Settings
			Browser-Within-a-Browser
			Full-Screen Mode
		Browser Notifications
		Email Client Settings
		Firewalls
		Phishing-Resistant MFA
		Password Managers
		VPNs
		Prevent Unauthorized External Domain Collaboration
		DMARC
		End Users Should Not Be Logged on as Admin
		Change and Configuration Management
		Mobile Device Management
		Summary
	Chapter 10 Advanced Defenses
		AI-Based Content Filters
		Single-Sign-Ons
		Application Control Programs
		Red/Green Defenses
		Email Server Checks
		Proactive Doppelganger Searches
		Honeypots and Canaries
		Highlight New Email Addresses
		Fighting USB Attacks
		Phone-Based Testing
		Physical Penetration Testing
		Summary
Part IV Creating a Great Security Awareness Program
	Chapter 11 Security Awareness Training Overview
		What Is Security Awareness Training?
		Goals of SAT
		Senior Management Sponsorship
		Absolutely Use Simulated Phishing Tests
		Different Types of Training
			Videos
			Make Sure Content Is Up-to-Date
			Posters and Newsletters
			Games
			Quizzes
			Mobile Apps
			Immediate Lessons upon Failure
			Educate about the Signs of Social Engineering
			Teach How to Recognize Rogue URLs
			USB Key Attacks
			Voice-Based Social Engineering
			SMS-Based Phishing
			Communication Tools
			In-Person Attacks
			Champion Programs
			BEC Scams
			Spear Phishing
			Increase Sophistication and Maturity over Time
			Train Like You Are Marketing
		Compliance
		Localization
		SAT Rhythm of the Business
		Reporting/Results
		Checklist
		Summary
	Chapter 12 How to Do Training Right
		Designing an Effective Security Awareness Training Program
			Set Program Objectives
			Getting Leadership Support
			Form a Steering Committee
			Training Frequency and Time Allocation
			Audience Analysis
			Accessibility
			Assessment
		Building/Selecting and Reviewing Training Content
			Selecting Content
			Create or Buy?
			Review by Steering Committee
			Interactivity
			Learning Objectives
			Reviewing Content
			Communicating the SAT Plan
			Deployment Tips
			Ongoing Evaluation and Maintenance
		Additional References
		Summary
	Chapter 13 Recognizing Rogue URLs
		How to Read a URL
			Protocol Moniker
			Hostname
			DNS Domain Name
			Resource Name or Path
			Variables
		Most Important URL Information
		Rogue URL Tricks
			Look-Alike Domains
			Strange Origination Domain
			Hover, Bait, and Switch
			Shortened URLs
			URL Encoding
			Malicious Open Redirects
			Homoglyphs and Punycode Attacks
		Summary
	Chapter 14 Fighting Spear Phishing
		Background
		Spear Phishing Examples
			Compromised Trusted Email Account
			Spearphishing on Inside Confidential Information
			Fake Job Offers
			Fake Vendor Support
			Credit Card Fraud Prevention
			Personal to Company Attack
		How to Defend Against Spear Phishing
		Summary
	Chapter 15 Forensically Examining Emails
		Why Investigate?
		Why You Should Not Investigate
		How to Investigate
		Examining Emails
			Message Body
			Disjointed Email Addresses
			Strange Body or Attachments
			Instructions to Ignore Warnings
			Password-Protected File Attachments
			Spotting Rogue URLs
			File-Type Mismatches
			Email Header Inspection
		Clicking on Links and Running Malware
		Submit Links and File Attachments to AV
		The Preponderance of Evidence
		A Real-World Forensic Investigation Example
		Summary
	Chapter 16 Miscellaneous Hints and Tricks
		First-Time Firing Offense
		Text-Only Email
		Memory Issues
		SAT Counselor
		Annual SAT User Conference
		Voice-Call Tests
		Credential Searches
		Dark Web Searches
		Social Engineering Penetration Tests
		Ransomware Recovery
		Patch, Patch, Patch
		CISA Cybersecurity Awareness Program
		Passkeys
		Avoid Controversial Simulated Phishing Subjects
		Practice and Teach Mindfulness
		Must Have Mindfulness Reading
		Summary
	Chapter 17 Improving Your Security Culture
		What Is a Security Culture?
		Seven Dimensions of a Security Culture
			Attitudes
			Behaviors
			Cognition
			Communication
			Compliance
			Norms
			Responsibilities
		Improving Security Culture
			Baseline Measurement
			Set a Goal
			Identify Gaps and Apply Tactics
			Remeasure Maturity Level
		Other Resources
		Summary
Conclusion
Acknowledgments
About the Author
Index
EULA