97 Things Every Information Security Professional Should Know

Chapter 85. Phishing Reporting Is the Best Detection

Steven Becker

Phishing and email social engineering threats rank among the top attacks faced by organizations of all types. Credentials being leaked to attackers of all kinds are leveraged into business email compromise, fraudulent transactions, espionage, ransomware, and other scenarios. There are a number of security controls and products that block most spam and phishing, but getting your colleagues to report suspicious emails is critical to finding and remediating issues from the messages that still get through.

Many email-based social engineering attacks will not target a single address. If as few as 10 email addresses are targeted to an organization with a reporting rate of 10%, that means that 1 person reporting the message can help the security team locate 9 other targets, often before an incident occurs. Having the security team build a culture that encourages reporting suspicious messages will add to the success of an incident response team, and this scales to organizations of every size.

Building this security culture means that every suspicious message that is reported must be received willingly, and without any negative judgment. IT and security teams often have a stereotype of a gruff personality, and this must be broken by showing empathy and care to every reported message, especially when an attack may have been ...