Description

This curriculum spans the breadth of a multi-workshop organizational rollout, addressing phishing risk with the granularity of an internal capability program designed to align technical controls, legal obligations, and executive governance across enterprise functions.

Module 1: Understanding the Phishing Threat Landscape

Select whether to classify phishing as a standalone risk or as a vector within broader social engineering threats in the enterprise risk register.
Determine which threat intelligence sources (commercial, ISACs, open-source) to integrate for real-time phishing campaign tracking.
Decide how frequently to update the organization’s phishing typology (e.g., spear phishing, whaling, smishing) based on observed attack patterns.
Evaluate whether to include supply chain phishing (e.g., vendor compromise) in third-party risk assessments.
Assess the relevance of regional phishing trends when operating in multiple jurisdictions with differing attacker profiles.
Choose metrics for measuring phishing prevalence (e.g., volume of reported emails, blocked URLs) across business units.
Implement logging standards for phishing attempts to ensure consistency in incident reporting and analysis.
Balance transparency in threat disclosure with the risk of causing unnecessary alarm among non-technical stakeholders.

Module 2: Legal and Regulatory Implications of Phishing Incidents

Determine whether a phishing compromise meets the threshold for mandatory data breach reporting under GDPR, CCPA, or HIPAA.
Decide which internal legal counsel (privacy, compliance, or litigation) leads the response based on the nature of compromised data.
Establish retention periods for phishing-related communication logs in alignment with e-discovery requirements.
Assess liability exposure when phishing leads to unauthorized fund transfers or contract alterations.
Implement procedures for preserving phishing email metadata for potential forensic or legal proceedings.
Define roles for legal review in public statements following a phishing-related incident.
Negotiate contractual clauses with vendors requiring phishing incident notification timelines and remediation obligations.
Map phishing controls to regulatory frameworks such as NIST, ISO 27001, or SOX to support audit readiness.

Module 3: Organizational Roles and Accountability for Phishing Defense

Assign ownership of phishing response between security operations, IT, legal, and communications teams.
Determine whether the CISO, CIO, or Chief Risk Officer has final authority over phishing mitigation investments.
Establish escalation paths for high-risk phishing attempts targeting executive leadership.
Define reporting lines for employees who identify phishing emails outside standard reporting tools.
Decide whether to create a dedicated phishing response team or rely on existing incident response structures.
Implement accountability metrics for department heads based on phishing click-through rates in simulations.
Clarify HR’s role in disciplinary actions for repeated failure to follow phishing reporting protocols.
Coordinate between internal audit and security to assess phishing control effectiveness annually.

Module 4: Risk Assessment and Phishing Exposure Modeling

Select asset criticality criteria (e.g., data sensitivity, system availability) to prioritize phishing protection efforts.
Decide whether to use qualitative (risk matrices) or quantitative (FAIR) models for phishing risk valuation.
Incorporate employee role and access level into phishing susceptibility scoring for high-privilege accounts.
Adjust risk scores based on observed phishing success rates from previous simulation campaigns.
Determine acceptable levels of phishing risk for different business units based on operational tolerance.
Integrate phishing risk into enterprise-wide risk dashboards for executive review.
Model the cascading impact of credential theft from phishing on downstream systems and data stores.
Validate risk model assumptions through red team exercises that simulate targeted phishing attacks.

Module 5: Email Security Infrastructure and Control Selection

Choose between on-premises, cloud-hosted, or hybrid email security gateways based on data residency and scalability needs.
Configure DMARC, SPF, and DKIM policies to prevent domain spoofing while minimizing legitimate email rejection.
Decide whether to implement URL rewriting and real-time link detonation in email flows.
Evaluate third-party email security vendors based on false positive rates and integration capabilities.
Set thresholds for quarantining suspicious emails and define user access to quarantine folders.
Implement email header analysis rules to detect anomalies in routing and authentication.
Balance email security controls with performance impact on message delivery latency.
Define exception processes for business units requiring less restrictive email filtering.

Module 6: Phishing Awareness Training and Behavioral Change

Select training frequency and format (e.g., microlearning, live workshops) based on department risk profiles.
Customize phishing scenarios in training content to reflect industry-specific attack patterns (e.g., invoice fraud in finance).
Determine whether simulation campaigns should be announced or unannounced to measure real-world behavior.
Set performance benchmarks for reducing click-through rates across business units over time.
Implement feedback mechanisms for employees who report phishing attempts to reinforce positive behavior.
Address resistance from senior leaders who opt out of mandatory training sessions.
Track completion rates and knowledge retention through post-training assessments.
Integrate phishing awareness into onboarding for new hires and third-party contractors.

Module 7: Incident Response and Containment Procedures

Define criteria for initiating a formal incident response based on phishing email reach and user interaction.
Activate playbooks for credential reset, session termination, and endpoint scanning following credential submission.
Coordinate with email providers to remove phishing messages from inboxes across the organization.
Decide whether to temporarily block external email during widespread phishing campaigns.
Preserve phishing email artifacts for root cause analysis and threat intelligence enrichment.
Implement network segmentation rules to limit lateral movement after phishing-induced compromise.
Notify affected customers or partners when phishing leads to data exposure.
Conduct post-incident reviews to update detection rules and response workflows.

Module 8: Metrics, Monitoring, and Continuous Improvement

Select KPIs such as time to detect phishing, mean time to respond, and user reporting rates.
Configure SIEM rules to correlate phishing alerts with authentication anomalies and data exfiltration attempts.
Implement dashboards that track phishing trends across departments and geographies.
Adjust control effectiveness thresholds based on evolving attacker tactics and user behavior.
Conduct quarterly reviews of phishing metrics with executive leadership and board members.
Compare internal phishing performance against industry benchmarks from peer organizations.
Use simulation data to identify departments requiring targeted retraining or process changes.
Validate monitoring coverage by testing detection of simulated phishing emails in production.

Module 9: Third-Party and Supply Chain Phishing Risks

Include phishing resilience in vendor security questionnaires and pre-contract assessments.
Require third parties to report phishing incidents involving shared systems or data.
Assess the risk of phishing through vendor communication channels (e.g., fake invoices from suppliers).
Implement monitoring for impersonation of partner brands in customer-facing phishing campaigns.
Define contractual obligations for incident response coordination when a vendor is compromised via phishing.
Extend phishing simulations to critical vendors under controlled conditions to evaluate readiness.
Restrict third-party access privileges based on phishing exposure history and security posture.
Integrate vendor phishing incidents into enterprise risk scoring and audit planning.

Module 10: Governance Integration and Executive Oversight

Present phishing risk posture and trends in quarterly reports to the board or risk committee.
Align phishing control investments with enterprise risk appetite statements and tolerance levels.
Define escalation criteria for reporting major phishing incidents to executive leadership.
Incorporate phishing resilience into enterprise-wide cyber risk appetite frameworks.
Require business unit heads to sign annual attestations of phishing policy compliance.
Link executive compensation or performance reviews to phishing risk reduction targets.
Conduct tabletop exercises with senior leaders to test decision-making during phishing crises.
Review insurance policy coverage for phishing-related losses during annual renewals.