The document outlines a comprehensive strategy to combat phishing attacks, highlighting the alarming statistics regarding victims' responses to phishing emails. It proposes zero-cost measures such as raising awareness, social media usage, and modifying email subjects and footers, alongside reinforcing firewalls and monitoring outbound traffic. Additionally, it emphasizes the gamification of detection and reporting to enhance organizational resilience against phishing threats.

1. BREAKING A CO M PRE HE NS IVE
STRATE GY TO
RE S PO ND TO
PHIS HING ATTACKS
PHISHING CHAIN
R AF E E Q U . R E HM AN
CE N T R A L O H I O IS S A S U M M I T, M A R C H 3 0 2 0 1 6

2. PHISHING TAILS
THE RECRUITER, THE JOB SEAKER,
AND CASE OF A CLONED DIGGER MACHINE

3. CURRENT STATUS
• CYBER ESPIONAGE - MORE
THAN TWO THIRD INVOLVED
PHISHING
• VICTIMS - 23% OPEN
PHISHING EMAIL
• HALF CLICK ON LINKS
WITHIN FIRST HOUR
• IT TAKES 82 SECONDS TO
GET FIRST CLICK
How Bad It
Really Is?
SOURCE:
Verizon Data Breach Investigations Report 2015

4. PHISHING CHAIN
• RESEARCH AND CRAFT EMAIL
• SEND PHISHING EMAIL
• CREATE BACKDOOR
AND/OR INSTALL
MALWARE
• DOWNLOAD ADDITIONAL
MALWARE COMPONENTS
• GATHER INFORMATION
• EXFILTERATE DATA
Typical Attack
Patterns

5. Sto p Bleeding I nfo r matio n o n So cial Media
Use SPAM Filter s
Sandbo xing Techno lo g ies (expensiv e)
H uman Fir ew all
Desk to p H ar dening , White Listing , I nteg r ity C heck ing
O utbo und Fir ew all Rules
HOW TO MITIGATE RISK
A SIX STEP APPROACH TO BREAK THE PHISHING CHAIN

6. ZERO COST
• RAISING THE AWARENESS
• SOCIAL MEDIA USE
• EMAIL SUBJECT, FOOTER
REWRITING
• FIREWALL RULES AND
OUTBOUND DROPPED
TRAFFIC MONITORING
• TESTING FIREWALLS
• OTHERS
TOOLS
S H O U L D I B U Y N E W TO O L S O R
U S E W H A T I H A V E ?

7. Verizon Data Breach Digest
Attack-Defend
Cards
R A IS ING T HE A WA R ENES S
SOURCE:
http://www.verizonenterprise.com/resources/reports/rp_data-breach-digest_xg_en.pdf

8. SOCIAL MEDIA USE
The Killer Job Offer that Nobody can Resist
HELLO RAFEEQ,
I AM EX EC UTIVE REC RUITER AN D TRYIN G TO FILL SEN IOR DIREC TOR
POSITION AT …
Z E R O C O S T M E A S U R ES F O R B R E A K I N G P H I S H I N G C H A I N

9. SOCIAL MEDIA USE
EDUCATE, BUILD AWARENESS, TEST
Z E R O C O S T M E A S U R ES F O R B R E A K I N G P H I S H I N G C H A I N
WHAT IS APPROPRIATE TO INCLUDE IN ONLINE PROFILES?
DO MY ACCOMPLISHMENTS SECTION REVEAL TOO MUCH INFO?
WHAT ACRONYMS I USE ONLINE?
TEST LEVEL OF AWARENESS (OPEN SOURCE TOOLS)

10. EXTERNAL EMAIL REWRITE
Subject: [EXTERNAL] …
Footer: [Caution] This email …
Z E R O C O S T M E A S U R ES F O R B R E A K I N G P H I S H I N G C H A I N
MOST EMAIL SYSTEMS ALLOW REW RITIN G SUBJ EC T LIN ES AN D ADDIN G FOOTERS

11. OUTBOUND FIREWALL RULES
RESTRICT OUTBOUND TRAFFIC
Z E R O C O S T M E A S U R ES F O R B R E A K I N G P H I S H I N G C H A I N
RESTRICT OUTBOUND FIREWALL TRAFFIC
MONITOR OUTBOUND DENIED TRAFFIC
TEST USING TOOLS LIKE NC AND NMAP

12. USE HUMAN FIREWALL
REDUCE DETECTION TIME
Z E R O C O S T M E A S U R ES F O R B R E A K I N G P H I S H I N G C H A I N
GAMIFICATION OF DETECTION, REPORTING, RECOGNITION
LIN K IN FOOTER TO REPORT PH ISH IN G
ADD REPORT PH ISH IN G BUTTON

13. SUMMARY
• SOCIAL MEDIA POLICIES
• TRAINING AND
AWARENESS
• USE EXISTING
TECHNOLOGIES
• USE EMAIL SYSTEM:
SUBJECT OR FOOTERS
• HARDEN DESKTOPS,
APPLY PATCHES
• RESTRICT OUTBOUND
TRAFFIC (FIREWALLS)
• MONITOR DENIED TRAFFIC
RECOMMENDED
ACTION

14. CONTACT
RAFEEQ.REHMAN@GMAIL.COM
@RAFEEQ_REHMAN