Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

Making phishing harder for one department

Business email compromise remains the most commonly reported incident type, and in essentially every case where MFA was deployed it was defeated rather than absent. The technical layer is worth doing and it is not the layer that decides the outcome.

For. Anyone asked to reduce phishing risk without a budget

  1. 01

    Fix your own domain first, so yours cannot be spoofed

    an afternoon

    SPF, DKIM and a DMARC policy that actually enforces. Most domains stop at p=none, which reports and blocks nothing, and a domain sitting on p=none for two years is a domain somebody else can send as.

    how to know it workedSend to a mailbox at a different provider and read the authentication headers. Then check the DMARC aggregate reports rather than assuming: they name every sender using your domain, including the ones your own marketing team forgot to tell you about.

  2. 02

    Mark external mail, once, unmissably

    minutes

    An external sender banner is worth having and it decays: applied to every message, people stop seeing it within a fortnight. It works better when it is loud on first contact from an address nobody in the organisation has corresponded with before, and quiet otherwise.

    how to know it workedSend yourself an external message from a new address and confirm the banner is there and reads clearly on a phone, which is where most people will meet it.

  3. 03

    Restrict who can consent to applications

    minutes

    The technique that beats MFA is not a bypass: it is a consent grant, which never meets a login prompt at all. Restrict user consent to verified publishers and low-impact scopes, and run an admin consent workflow. It is a tenant setting, it is free, and it is permissive by default.

    how to know it workedTry to grant consent as an ordinary user to a test application requesting Mail.Read. You should be asked to request approval rather than approving it yourself.

  4. 04

    Make the payment step resistant to a convincing email

    an afternoon

    Most BEC ends in a payment or a change of bank details. A rule that any change of banking details is confirmed by a call to a number already on file, never a number in the email, removes the outcome even when the phishing works. This is a finance process change and it is the highest-value item here.

    how to know it workedAsk somebody in finance to describe what they would do. If the answer is not the callback rule, it is not in place regardless of what the policy document says.

  5. 05

    Make reporting faster than deleting

    an afternoon

    A report button in the mail client, and an answer to every report. The reason people stop reporting is not laziness, it is that nothing visible happened the last three times, so the message that matters is the one you never hear about.

    how to know it workedMeasure time to first response on reports. If it is longer than a day, reporting is decaying whatever the volume looks like.

what this does not cover

  • A compromised supplier sending from their real domain, which passes every authentication check because it is genuine
  • Anything that arrives outside email: a message in a collaboration tool or a text to a personal phone routes around all of this
  • The consent grant that was accepted before you restricted consent, which stays valid until it is revoked