Fighting Phishing

CHAPTER 5Anti-Phishing Policies

Chapter 5 covers many of the policies you need to share with co-workers, family members, and friends, to fight social engineering and phishing.

The Importance of Anti-Phishing Policies

A big part of mitigating the threat of malicious social engineering and phishing is education. In an organization, that education begins with enacting, documenting, and communicating policies that fight social engineering and phishing. This chapter will cover many of those policies. All employees should review anti-phishing policies and sign an acknowledgment of having done so when hired and annually thereafter.

It is clear that all organizations need a specific anti-phishing policy. It can even be easily argued that not having specific anti-phishing policies leads to a greater risk of successful compromise. As discussed in Chapter 1, “Introduction to Social Engineering and Phishing,” social engineering and phishing are likely involved in 70% to 90% of successful hacking attacks. It is, therefore, a little strange that most organizations do not have specific policies against the number one most popular type of hacking.

Imagine if your house was being frequently robbed, and almost always by thieves coming through the windows. The thieves could break into the house using any number of other avenues (e.g., doors, garage, walls, floor, roof, chimney, attic, basement, etc.), but you have noticed that for over three decades they prefer to break in almost all the time ...