Home › Resources › Phishing

Executive Summary

Phishing is a social engineering attack in which fraudulent messages, most often email, impersonate a trusted person or organization to trick the recipient into revealing sensitive information, clicking a malicious link, or running harmful software. It is the most common way attackers gain their first foothold in an organization. Because it targets human trust rather than a technical flaw, no single tool stops it, and awareness plus layered controls matter most.

What It Is

Phishing is an attempt to deceive a person into acting against their own or their employer's interest by pretending to be someone they trust. The classic form is a broad email blast impersonating a bank, a shipping company, or an internal department, urging the reader to log in, confirm a payment, or open an attachment. The goal is usually to harvest credentials through a fake login page, deliver malware through an attachment or link, or convince the victim to send money or data. Phishing is the umbrella term for a family of related attacks that target specific people (spear phishing), executives (whaling), or use other channels such as text messages (smishing) and voice calls (vishing).

Why It Matters

Phishing is the starting point for a large share of serious breaches, including ransomware and business email compromise, because stolen credentials or a single opened attachment can give an attacker the access they need. It is cheap to run at scale, easy to automate, and effective because it exploits normal human habits such as trusting familiar logos and reacting quickly to urgent requests. For organizations, one successful phishing message can lead to data theft, financial loss, regulatory exposure, and reputational damage. For professionals, recognizing and reporting phishing is now a baseline expectation in nearly every role, and defending against it is a core skill across security operations, incident response, and governance.

How It Works

A phishing campaign begins with a lure, a message crafted to look legitimate and to prompt a specific action. The attacker relies on visual imitation (familiar branding and layouts), plausible pretext (a password reset, an invoice, a delivery notice), and psychological pressure (urgency, fear, or curiosity). When the recipient clicks a link, they are typically taken to a counterfeit website that captures whatever they type, or a file downloads and attempts to run malicious code. Stolen credentials are then used directly, sold, or fed into further attacks. Modern phishing often defeats simple filters by using freshly registered domains, look-alike addresses, hijacked legitimate accounts, and links that only turn malicious after delivery, which is why layered defenses and human vigilance both matter.

Architecture Diagram

Visual Workflow

Common Attacks

• Credential harvesting through a counterfeit login page that mimics a real service
• Malicious attachments that install malware when opened
• Look-alike or spoofed sender addresses that appear to come from a trusted party
• Urgent pretexts such as fake password resets, invoices, or delivery notices
• Hijacked legitimate accounts used to send phishing from a trusted inbox

Common Mistakes

• Assuming email filters catch everything and lowering personal vigilance
• Judging a message as safe based only on a familiar logo or display name
• Clicking links to check them rather than navigating to the site directly
• Making it hard or embarrassing for staff to report a suspected phishing email
• Relying on passwords alone without multi-factor authentication as a backstop

Best Practices

• Deploy an email security gateway with link and attachment analysis
• Enforce multi-factor authentication so stolen passwords alone are not enough
• Publish sender authentication with SPF, DKIM, and DMARC to reduce spoofing
• Run continuous awareness training and realistic simulations
• Make reporting a suspected phishing message fast and blame-free
• Verify unexpected payment or credential requests through a separate channel

Quick Checklist

• Email gateway with URL and attachment inspection is active
• Multi-factor authentication enforced on email and key accounts
• SPF, DKIM, and DMARC configured and monitored for the domain
• One-click report-phishing button available to all staff
• Regular phishing simulations run and results acted on
• Documented process to contain and reset compromised accounts quickly

Recommended Tools

Industry Standards

Career Relevance

Phishing defense touches nearly every security role. SOC analysts triage reported messages and hunt for compromise, incident responders contain accounts that were tricked, and security awareness leads design the training and simulation programs that reduce click rates. Security engineers tune email gateways and authentication, while GRC analysts assess phishing resilience and awareness maturity against frameworks. For the AI-Governance-Jobs.com audience, phishing literacy is foundational across security and governance work.

Interview Questions

• What is phishing, and how does it differ from spear phishing and whaling?
• What are the strongest technical controls against credential-harvesting phishing?
• How do SPF, DKIM, and DMARC work together to reduce spoofing?
• Why does multi-factor authentication limit the damage of a phished password?
• Walk me through how a SOC should handle a user-reported phishing email.

Related Certifications

Further Reading

• CISA: Avoiding Social Engineering and Phishing Attacks
• FTC: How to Recognize and Avoid Phishing Scams
• DMARC.org

FAQ