📘CCNP security (350-701)
1. Introduction
Phishing and social engineering attacks target people, not systems.
Instead of breaking security devices, attackers trick users into giving information, clicking links, opening files, or approving actions.
Because these attacks rely on human behavior, technical security alone is not enough.
Organizations must use a combination of technical controls, process controls, and user-focused controls.
2. Understanding the Threat
Phishing
Phishing is an attack where an attacker pretends to be a trusted source and sends messages to:
- Steal usernames and passwords
- Deliver malware
- Trick users into sending sensitive data
Common phishing methods:
- Email phishing
- SMS phishing (smishing)
- Voice phishing (vishing)
- Fake login pages
- Malicious links or attachments
Social Engineering
Social engineering is a broader concept where attackers:
- Gain trust
- Create urgency or fear
- Impersonate employees, vendors, or IT staff
- Manipulate users into performing actions
3. Technical Controls Against Phishing
3.1 Email Security Gateways
Email security gateways inspect incoming and outgoing emails.
They provide:
- Spam filtering
- Malicious attachment scanning
- URL reputation checks
- Impersonation detection
Functions include:
- Blocking emails from known malicious domains
- Rewriting URLs to check them at click time
- Quarantining suspicious messages
These gateways reduce phishing before it reaches users.
3.2 Anti-Malware and Sandboxing
Attachments and links are analyzed using:
- Signature-based detection
- Behavior-based detection
- Sandboxing (isolated execution)
If a file:
- Downloads malware
- Tries to contact command-and-control servers
- Modifies system files
It is blocked automatically.
3.3 DNS Security and Web Filtering
DNS and web security controls prevent users from visiting malicious websites.
They work by:
- Blocking known phishing domains
- Blocking newly registered suspicious domains
- Preventing access to fake login portals
Even if a user clicks a phishing link, access can be stopped.
3.4 Email Authentication (SPF, DKIM, DMARC)
These controls prevent email spoofing.
- SPF: Verifies authorized mail servers for a domain
- DKIM: Uses digital signatures to verify message integrity
- DMARC: Defines policy for handling spoofed emails
Together, they:
- Prevent attackers from impersonating trusted domains
- Reduce business email compromise (BEC)
3.5 Multi-Factor Authentication (MFA)
MFA adds an extra layer of authentication beyond passwords.
Even if credentials are stolen:
- Attacker cannot log in without the second factor
- Access attempts are logged and detected
Common MFA factors:
- One-time passwords
- Push notifications
- Hardware tokens
MFA is one of the most effective controls against phishing.
3.6 Endpoint Protection
Endpoint security software protects user devices.
It can:
- Block malicious downloads
- Detect phishing-related malware
- Prevent credential-stealing tools
Modern endpoint tools use:
- Behavioral analysis
- Machine learning
- Threat intelligence feeds
4. Identity and Access Controls
4.1 Least Privilege Access
Users should only have access required for their role.
If a user account is compromised:
- The attacker’s access is limited
- Damage is reduced
This minimizes the impact of successful social engineering.
4.2 Privileged Access Management (PAM)
PAM controls high-risk accounts such as:
- Administrators
- Service accounts
Features include:
- Approval workflows
- Session monitoring
- Temporary access
This prevents attackers from gaining powerful access through social engineering.
5. User Awareness and Training Controls
5.1 Security Awareness Training
Training helps users:
- Identify phishing emails
- Recognize fake login pages
- Avoid clicking unknown links
- Verify requests for sensitive information
Training should be:
- Regular
- Updated
- Easy to understand
This is critical because users are the primary target.
5.2 Phishing Simulations
Organizations send simulated phishing emails to users.
Purpose:
- Measure awareness
- Identify risky behavior
- Improve training effectiveness
Results are used to:
- Improve security culture
- Reduce real-world phishing success
5.3 Clear Reporting Mechanisms
Users must know how to:
- Report suspicious emails
- Report suspicious phone calls
- Report unusual system behavior
Examples:
- “Report Phishing” button
- Dedicated security email address
Fast reporting reduces damage.
6. Process and Policy Controls
6.1 Security Policies
Policies define:
- How sensitive data is handled
- How credentials are protected
- How requests are verified
Clear policies reduce confusion and mistakes.
6.2 Verification Procedures
Critical actions should require verification.
Examples:
- Identity confirmation before password resets
- Approval workflows for financial or system changes
- Call-back or secondary confirmation
These steps prevent impersonation attacks.
6.3 Incident Response Procedures
Organizations must have procedures for:
- Phishing detection
- Account compromise
- Malware infection
Quick response helps:
- Disable compromised accounts
- Reset credentials
- Contain the attack
7. Monitoring and Detection Controls
7.1 Log Monitoring and SIEM
Security tools monitor:
- Login anomalies
- Unusual access times
- Abnormal user behavior
SIEM systems correlate events to:
- Detect compromised accounts
- Alert security teams early
7.2 User and Entity Behavior Analytics (UEBA)
UEBA tools detect:
- Abnormal login behavior
- Suspicious user activity after phishing
This helps detect attacks that bypass initial defenses.
8. Zero Trust and Defense-in-Depth
Phishing defenses must follow defense-in-depth:
- Multiple layers of security
- No single control is trusted
Zero Trust principles:
- Never trust by default
- Always verify identity
- Continuously monitor activity
This limits the success of social engineering.
9. Key Exam Points to Remember
For the 350-701 exam, remember:
- Phishing targets people, not systems
- Technical controls alone are not enough
- MFA significantly reduces phishing impact
- Email security, DNS filtering, and endpoint protection work together
- User awareness is critical
- Policies and procedures support technical defenses
- Monitoring and incident response limit damage
10. Summary
Phishing and social engineering are human-focused attacks, so protection requires:
- Technical controls (email security, MFA, endpoint protection)
- Identity controls (least privilege, PAM)
- User awareness and training
- Policies, procedures, and monitoring
A layered security approach ensures that even if one control fails, others still protect the organization.
