4.1 Stopping Phishing Attacks

00:02

hi and welcome the Module four and Cyber is crafting the perfect email course. Now that we've gone over re Kon crafting and sent our phishing emails, what can we do to help stop or mitigate them in your organization?

00:17

So one of the main reasons I love to perform fishing campaigns is actually to help the user's. My goal isn't to trip the user, but instead to educate them. I want them to be able to detect my phishing emails and be able to tell me that they found one that I sent out.

00:34

Really, that'll help make our network more secure and also make me a better social engineer, because I'm gonna have to try and

00:41

use more advanced techniques or learn new things to get those emails by

00:47

so insecurity. Our goal that we sometimes forget is to improve the overall security posture of an organization, and we can use

00:55

the user's toe. Help us.

00:58

Um, one thing I like to do is all actually involve users. When I plan a fishing campaign, I'll ask them what they may have seen or heard about. Maybe they recently fell for a fishing attempt in their personal life or somewhere else do they know or understand why that happened?

01:12

When you involve a user, it'll give them a sense of responsibility and empowerment, and it really gets them interested in helping to defend the network, which really helps you as well.

01:25

The first step in educating users is teaching them how to recognize phishing emails and attempts. If we can get users to recognize a phishing email and report it right away, we may be able to prevent other users from being fished.

01:40

Now we're going to use what we've already learned in writing a phishing email to help our users recognise one.

01:48

So do you remember what the five keys are to creating a phishing E mail?

01:53

The 1st 1 was sender. Make sure to verify, always verify the sender and make sure that your users no addresses can be spoofed.

02:01

Subject. Does this subject make sense? Is it something they normally see from this person? Does it uses different wording? Is a type a little bit differently? Those are all things to look for when recognizing a phishing e mail

02:15

again, the email address view the header information to verify where the email actually came from, and This is something I'll show you how to do in the lab, and we can shore users how to do this as well, or at least get that information so you can verify it.

02:30

Then we'll go into the email details. Does wth E e mail actually make sense? Can you tell if it has maybe too much information? It's trying too hard to look legitimate.

02:40

Does anything look strange or out of place? These are all things to look for when you're reading an email that you think may be a phishing email

02:49

and, lastly emotional buying. That's the big one for social engineers. We want to get the user emotionally involved. This will limit their rational thinking. This is something you can use to help your users tell them this.

03:02

Remember to take a second and re read the email. Don't react immediately if you get an email from your bank saying that your account has been hacked and they need you to log in to verify some charges or you're gonna lose all your money. Remember to take a deep breath and call your bank. Go to the bank's website.

03:21

We want to verify any information that we can and make sure it's correct before taking any action.

03:27

And one thing to always remind our users is to never click any links or download any attachments that they weren't expecting.

03:37

So how do we view header information? I've got a screen shot here from Outlook. You can click the little button that's highlighted there, or you can actually go to file properties and then Internet headers, and that'll give you the full header information.

03:52

In Gmail, it's pretty easy as well. We can use the three dots in the upper right,

03:57

then show original, and what we can do is Ian Copy. That's the clipboard and pace it in Google's Hatter decoder,

04:03

and that will help us go over any information that we need. And I will go ahead and hop in our lab here and actually show you that.

04:13

So, as you can see, I've got our phishing email from yesterday up so again in Google to view the header information, you click the

04:20

three little dots there and we're gonna do show original,

04:26

and this will take and show us the whole header, and the main thing we're looking for is the I. P address that the server that sent the email out from

04:33

And so what we're gonna do is just copied all this information to the clipboard. This is what you can have your users do and send that to you. See, you can decode it for him.

04:42

But what will do then is go to toolbox dot google maps dot com slash aps slash message header slash analyze header. And you could say I've already done this one. You know what? Let's go it. This is what it looks like when you get there. So go ahead and control V or right click and paste

05:00

and then analyze the header above.

05:03

And you could see this is the message i d from google dot com. This is when it was created. This is who is from the cyber security team

05:13

and this is the actual email that it was from. So if you remember, we changed our display Ning to show the cyber very security team