The Phishing Email That Bypassed Filters
An employee in the accounting department received an email that appeared to come from the CEO, requesting a wire transfer of $50,000 to a new vendor. The email address was '[email protected]' but the display name was 'CEO Name'. The employee became suspicious because the CEO usually communicates via phone for such requests. The employee forwarded the email to the IT security team. The security team analyzed the email headers and found that the 'From' address was actually '[email protected]' (missing the 'm'), and the reply-to was '[email protected]'. The email passed SPF and DKIM checks because the sending server was authorized for 'company.co', which the company also owns but does not use for email. The company's email gateway uses a spam filter that checks SPF, DKIM, and DMARC, but DMARC policy is set to 'none'. The security team also found that the email contained a link to a fake login page that harvested credentials. The employee did not click the link. The company has a security awareness program but no simulated phishing tests.
1. What were the weaknesses in the email security configuration that allowed this phishing email to be delivered, and how could they be addressed?
Read the worked answer
Weaknesses: (1) DMARC policy set to 'none' means that even if DMARC fails, the email is still delivered; it only reports. An attacker can spoof the domain and the receiver will not reject. (2) The company owns 'company.co' but does not use it for email; they should either not own it or set up SPF/DKIM/DMARC for it to prevent abuse. Since the attacker used 'company.co' which has valid SPF/DKIM for that domain, the email passed authentication. (3) The spam filter relies on SPF/DKIM/DMARC but does not have advanced phishing detection (e.g., display name spoofing, lookalike domain detection). (4) No simulated phishing tests to train users. To address: (1) Change DMARC policy to 'quarantine' or 'reject' for company.com. (2) For company.co, either set up DMARC reject or let it expire if not used. (3) Implement advanced email security that checks for display name spoofing and lookalike domains. (4) Conduct regular phishing simulations. (5) Implement a process for verifying financial requests via phone. (6) Enable multi-factor authentication to protect credentials even if harvested.
2. What should the security team do immediately after this incident, and what long-term measures should be implemented?
Read the worked answer
Immediately: (1) Block the sender's IP and domain at the email gateway. (2) Warn all employees about the phishing attempt, especially accounting. (3) Check if any other employees received similar emails and if any clicked. (4) Reset credentials for any accounts that might have been compromised. (5) Review email logs for any other suspicious emails from 'company.co'. (6) Report the phishing to the relevant authorities if needed. Long-term: (1) Implement DMARC reject for company.com and company.co. (2) Deploy advanced email protection with impersonation detection. (3) Establish a verification process for financial transactions (e.g., call-back to known number). (4) Conduct regular security awareness training and simulated phishing. (5) Enable MFA for all email accounts. (6) Consider registering lookalike domains defensively. (7) Review and update incident response plan.