Phishing campaigns, recognition, response

5.6 Security awareness

📘CompTIA Security+ (SY0-701)

---

Phishing is a type of social engineering attack where attackers try to trick users into giving sensitive information, like passwords, credit card numbers, or access to systems. Security awareness programs teach employees how to recognize these attacks and respond appropriately.

---

1. Phishing Campaigns

Phishing campaigns are planned efforts by attackers to steal information or infect systems. Organizations also run internal phishing campaigns as part of security awareness to train employees.

Types of Phishing in IT:

1. Email Phishing
   • Attackers send emails pretending to be from a trusted source (like IT support or a service provider).
   • Example: An email appears to be from the company’s internal helpdesk asking you to “reset your password” using a link.
   • Goal: Steal login credentials or deliver malware.
2. Spear Phishing
   • Targeted phishing aimed at a specific person or department.
   • Example: A finance employee receives an email claiming to be from the CFO, asking for an urgent transfer of funds.
3. Whaling
   • Phishing targeting high-profile executives or decision-makers.
   • Example: CEO receives a fake invoice email requesting immediate payment.
4. Smishing & Vishing
   • Smishing: Phishing through SMS messages.
     • Example: “Your email account has been compromised. Click here to fix it.”
   • Vishing: Phishing over a phone call.
     • Example: A caller pretends to be IT support asking for your password to “fix an issue.”
5. Clone Phishing
   • Attackers duplicate a legitimate email that the user has received before and replace links or attachments with malicious ones.
6. Pharming (related)
   • Redirects a user from a legitimate website to a fake one to steal credentials.

---

2. Recognition of Phishing

Employees must recognize phishing attempts to protect sensitive information. Here’s what to look for:

Common Indicators in IT Environments:

1. Suspicious Email Address
   • Sender’s email looks similar but is slightly off.
   • Example: it-support@yourcompany.com vs. it-support@yourcompany-secure.com
2. Unexpected Attachments or Links
   • Links that don’t match the text or unexpected attachments.
   • Example: A PDF that asks to enable macros could be malware.
3. Urgency or Threats
   • Emails often create panic: “Your account will be deleted in 24 hours!”
4. Generic Greetings
   • “Dear user” instead of your actual name.
5. Spelling and Grammar Errors
   • Many phishing emails contain small mistakes.
6. Requests for Sensitive Information
   • Legitimate IT or HR departments usually don’t ask for passwords via email.

---

3. Response to Phishing

Even if a phishing email bypasses technical defenses, a trained employee can stop the attack.

Steps to Respond:

1. Do Not Click
   • Never click links or open attachments from suspicious emails.
2. Report to IT/Security Team
   • Forward the email to your security team or designated phishing-reporting address.
   • Example: Security@company.com
3. Verify if Needed
   • Contact the sender through a trusted method (e.g., phone or internal chat) to confirm legitimacy.
4. Delete the Email
   • After reporting, remove it from your inbox.
5. Follow Security Policies
   • Always follow your organization’s procedure for phishing incidents.
   • Example: Some organizations use automated phishing-reporting tools built into email clients.

---

4. Importance in Security Awareness Programs

• Phishing campaigns are one of the most common attack methods in IT environments.
• Regular training and simulated phishing campaigns help employees spot threats.
• Recognition and proper response reduce the risk of data breaches, malware infections, and credential theft.
• Organizations often track click rates and report metrics to improve training effectiveness.

---

Exam Tips for CompTIA Security+ SY0-701

• Know the types of phishing attacks: email, spear phishing, whaling, smishing, vishing, clone phishing.
• Be able to identify phishing indicators in emails and messages.
• Understand the correct response procedures: don’t click, report, verify, delete.
• Remember that internal phishing campaigns are part of security awareness training.
• Focus on reducing risk through awareness rather than just relying on technical controls.

---

✅ Key Takeaway:
Phishing is about tricking humans, not just hacking systems. The best defense is awareness, recognition, and proper response. Even the most secure systems fail if employees are not trained.