Full Report
This blog explores phishing and smishing, diving into how to analyze text messages for their validity and legitimacy.
Analysis Summary
# Best Practices: Phishing and Smishing Defense
## Overview
These practices address the identification, analysis, and mitigation of phishing (email-based) and smishing (SMS-based) attacks. The goal is to prevent unauthorized access to sensitive data and credentials by verifying the legitimacy of communication and infrastructure.
## Key Recommendations
### Immediate Actions
1. **Stop and Verify:** Do not click links or provide credentials in response to unsolicited texts or emails regarding "account suspensions" or "unusual activity."
2. **Sender Inspection:** Analyze the "From" address for domain inconsistencies (e.g., an Amazon alert coming from a `.art` or `.id` domain).
3. **Manual Login:** If a service alert is received, navigate to the official website manually via a known URL or official app rather than using the provided link.
4. **Use Defanged Tools:** Use sandboxed tools like `urlscan.io` to view screenshots of suspicious links without visiting them directly.
### Short-term Improvements (1-3 months)
1. **Security Awareness Training:** Implement regular training that specifically includes "smishing" (SMS phishing) simulations, as employees are often less guarded on mobile devices.
2. **MFA Implementation:** Deploy Multi-Factor Authentication (MFA) across all corporate accounts to ensure that even if a phish is successful, the credentials alone are insufficient for access.
3. **Report Mechanism:** Establish a clear, one-click process for employees to report suspicious emails or messages to the security team.
### Long-term Strategy (3+ months)
1. **Domain Monitoring:** Implement services to monitor for typosquatting or brand impersonation domains (e.g., variations of your company name).
2. **FIDO2/WebAuthn:** Move toward hardware-based security keys (like Yubikeys) which are inherently resistant to phishing, as they cannot be fooled by look-alike domains.
3. **Zero Trust Architecture:** Reduce the impact of compromised credentials by implementing identity-based access controls and continuous verification.
## Implementation Guidance
### For Small Organizations
- **Focus on Education:** Since budgets are tight, prioritize free resources like NIST guidelines to educate staff.
- **Enable Built-in Filters:** Ensure spam and phishing filters are enabled in Google Workspace or Microsoft 365.
### For Medium Organizations
- **Centralized Analysis:** Designate a security lead to use tools like **CentralOps Domain Dossier** to investigate reported threats.
- **Standardize Links:** Use a consistent, branded URL shortener for internal/customer communications so deviations are easily spotted.
### For Large Enterprises
- **Threat Intelligence Integration:** Integrate automated URL scanning and domain reputation feeds (like ICANN lookup data) into your SIEM/SOAR.
- **Email Authentication:** Fully implement SPF, DKIM, and DMARC (reject policy) to prevent attackers from spoofing your own domain.
## Configuration Examples
**Verification Checklist for Analysts:**
- **WHOIS Check:** Use `lookup.icann.org` to check the domain registration date. New domains (created within <30 days) are high-risk.
- **IP Attribution:** Use `centralops[.]net` to see if the IP hosting the link matches the legitimate company's infrastructure (e.g., Amazon should be on AWS/Amazon IPs, not third-party registrars like Tucows).
- **URL Inspection:** Check for character substitutions (P@ypal) or unusual TLDs (.art, .info, .xyz).
## Compliance Alignment
- **NIST SP 800-53:** Controls for System and Information Integrity (SI) and Awareness and Training (AT).
- **ISO/IEC 27001:** Annex A.7.2.2 (Information security awareness, education, and training).
- **CIS Control 14:** Security Awareness and Skills Training.
## Common Pitfalls to Avoid
- **Trusting "Known" Names:** Assuming a message is safe because the display name says "Amazon" or "IT Support."
- **Urgency Bias:** Falling for "Account Suspended" or "Immediate Action Required" lures that bypass critical thinking.
- **Mobile Complacency:** Assuming mobile devices are "safer" than desktops; smishing often bypasses traditional corporate email filters.
## Resources
- **Domain Analysis:** `centralops[.]net/co/DomainDossier.aspx`
- **Domain Registry Info:** `lookup[.]icann[.]org`
- **Safe URL Scanning:** `urlscan[.]io`
- **Frameworks:** `csrc[.]nist[.]gov/glossary/term/phishing`