A Case Study of Phishing Incident Response in an Educational Organization

Abstract

Malicious communications aimed at tricking employees are a serious threat for organizations, necessitating the creation of procedures and policies for quickly respond to ongoing attacks. While automated measures provide some protection, they cannot completely protect an organization. In this case study, we use interviews and observations to explore the processes staff at a large University use when handling reports of malicious communication, including how the help desk processes reports, whom they escalate them to, and how teams who manage protections such as the firewalls and mail relays use these reports to improve defenses. We found that the process and work patterns are a distributed cognitive process requiring multiple distinct teams with narrow system access and tactic knowledge. Sudden large campaigns were found to overwhelm the help desk with reports, greatly impacting staff's workflow and hindering the effective application of mitigations and the potential for reflection. We detail potential improvements to ticketing systems and reflect on ITIL, a common framework of best practice in IT management.

Context-Based Clustering to Mitigate Phishing Attacks

“…A best practice here is to ask users to report suspicious looking email which is then reviewed by help desk staff or a security team [29,34]. The major problem with this approach is scale and time [3,57]. If many users report emails then it takes time to manually review them, which means a slower response time to the attack and a slower response to the people reporting.…”

“…Therefore, employees are regularly told to report phishing to their organizations' computing support desk or Information Security (IS) teams. However, processing these reports at scale is quite challenging [3]. Problems range from the number of reports to the fact that phishing is specifically designed by attackers to bypass automated filters, making it challenging to automatically extract reliable features.…”

“…Given the risks and expenses involved, organizations go to great lengths to prevent phishing from being successful, best practice recommends a mix of proactive security measures like automated filters on email servers and reactive measures which include encouraging employees to report any phishing that they encounter [3,17,63]. While automated detection of phishing is impressively effective, with some algorithms achieving accuracy rates over 99% [22,25], it is still the case that some phishing makes it through into user inboxes.…”

Digitalization of Educational Services with Regard to Policy for Information Security

“…The ITIL (IT Infrastructure Library) [2], [10], [22] approach to IT management provides a set of best practices derived from the public and private sectors of various countries. ITIL is a set of rules that describe a systematic approach to IT deployment, implementation, and management.…”

"I didn't click": What users say when reporting phishing

“…Given the likelihood that a large scale phishing campaign will result in some people interacting with it, it is equally likely that other people will identify it. If those people report the phishing quickly, then the organization can take preventive measures like removing it from all staff email inboxes and blocking malicious links using a firewall [4]. In other words, it only takes one person reporting a phishing email to protect a whole organization from it.…”