97 Things Every Information Security Professional Should Know

Chapter 45. Phishing

Lauren Zink

Phishing is currently the most common form of digital social engineering, which is when someone tries to make a person perform an action or provide specific information they are soliciting through various means. Phishing more specifically is when an email is sent with malicious intent with the appearance of coming from a legitimate person or company. However, there are typically some red flags that should alert a receiver that the email is indeed nefarious, but not always.

The effectiveness of a simple phishing email can be shocking and eye opening to employees and the company. Usually, a phishing email will include a fraudulent link or an attachment. This is how the attacker is going to infiltrate the network to gain information about the receiver or the company. However, that is not always the case. Some emails may not include any links or attachments but may just be trying to solicit general information or get the receiver to complete an action.

Some general information that a phishing email may try to solicit includes personal or company information such as usernames, passwords, or other personally identifiable information (PII). The email may also ask for contact information directly related to other people within your company, bank routing information, or even IP address information. The email could even go as far as to impersonate or spoof ...