Phishing for Answers

This book explores the efficacy of cybersecurity and anti-phishing training and awareness programs, as well as internal messaging and discusses mitigation strategies.

---

In the context of information security, social engineering is the manipulation of people into performing actions or divulging information for the purpose of gathering, defrauding, or gaining unauthorized system access. While some of the most common forms of social engineering involve telephone or social networks where criminals pose as employees of targeted organizations, phishing accounts for 96% of all successful cyber-attacks. Governments and private organizations have responded through various means such as training employees, executing internal vulnerability assessments, and ad campaigns. Despite all these efforts, phishing continues to provide the primary cyber-attack vector for nefarious entities.


Phishing attacks continue to escalate, with over 300,000 reported incidents in the US alone last year. This book provides an in-depth look at the anatomy of modern phishing threats and how they are evolving with AI technologies. Readers will learn about the latest social engineering tactics used by cybercriminals, including deepfakes for audio/video manipulation and AI-generated spear-phishing campaigns, and discover emerging defensive tools that leverage machine learning to detect anomalies and protect against hyper-personalized phishing attempts. With phishing losses averaging millions per breach, this book equips readers with the knowledge to identify risks and implement robust countermeasures as these attacks become increasingly sophisticated and difficult to spot.


Written by two experts in the field, bringing together their wide experience in academic research, security engineering, incident response and cyber forensics, this book offers valuable insights for researchers, engineers, cybersecurity professionals and organizational leaders working in cyber security, information technology, network and infrastructure security, endpoint protection, data governance, risk and compliance, digital forensics, incident response, operational technology and industrial control systems.