Phishing

Phishing is a social engineering attack that tricks victims into revealing sensitive information or taking harmful actions through deceptive emails, messages, or websites.

Phishing is the most common initial attack vector, responsible for over 90% of security breaches.

Types of phishing: - Email Phishing: Mass emails impersonating trusted entities - Spear Phishing: Targeted attacks on specific individuals - Whaling: Targeting executives and high-value individuals - Smishing: SMS-based phishing - Vishing: Voice phishing via phone calls - Business Email Compromise (BEC): Impersonating executives for fraud

Common indicators: - Urgency or fear tactics - Suspicious sender addresses - Generic greetings - Spelling/grammar errors - Unusual requests

Defense layers: - Email filtering and authentication (SPF, DKIM, DMARC) - Security awareness training - Phishing simulations - MFA to limit credential theft impact - URL filtering

Why It Matters

Phishing is the initial access vector in over 90% of successful cyberattacks, making it the single greatest threat to most organizations. Technical controls catch the majority of phishing attempts, but sophisticated spear phishing and BEC attacks regularly bypass filters. Regular phishing simulations with immediate training feedback measurably reduce click rates over time, and MFA ensures that even successful credential theft doesn't result in account compromise.

Key Points

Responsible for 90%+ of security breaches

Email filtering alone is not sufficient

Regular phishing simulations improve awareness

MFA limits damage from successful phishing

Report suspicious emails to security team

Applicable Compliance Frameworks

SOC 2 ISO 27001 HIPAA

Related Terms

Security Awareness Training

Security awareness training educates employees about cybersecurity threats, safe practices, and their role in protecting organizational assets.

Email Security

Email security encompasses technologies and practices to protect email communications from threats like phishing, malware, and business email compromise.