An Enterprise Anti-phishing Framework

Abstract

Abstract. The objective of this paper is to report back on an organizational framework, which consisted of human, organization and technology (HOT) dimensions in holistically addressing aspects associated with phishing. Most anti-phishing literature studied either focused on technical controls or education in isolation however; education is core to all aspects in the above-mentioned framework. It is evident, from literature, that little work has been conducted on anti-phishing preventative measures in the context of organizations but rather from a personal user-level. In the framework, the emphasis is placed on the human factors in addressing phishing attacks.

"I didn't click": What users say when reporting phishing

“…Although these methods have been shown to be highly effective, they unlikely to ever reach 100% accuracy due to fact that phish are intentionally designed to bypass these technical barriers and deceive endusers. Hence, human judgement is considered an essential part of an organization's overall security posture [23].…”

A Taxonomy of Attacks and a Survey of Defence Mechanisms for Semantic Social Engineering Attacks

“…The prevalence of semantic attacks has resulted in a higher degree of applicability within policies that are integrated in internationally standardised frameworks ( [Calder and Watkins 2010;Ali 2014]). Dedicated Governmental Guidelines have also been proposed in ([GOVUK 2015;CPNI 2013;Calder and Watkins 2014;Jansen and Grance 2011]) as well as detailed methodologies and investigations in guide books and research ([Peltier 2013;Frauenstein and Solms 2013]). The book published by Peltier [2013] offers a comprehensive collation of strategies for implementing secure policy and process for IT governance; combining standards and best practice guidelines for integrating information security across organisational domains i.e.…”