Simulated Phishing Attack

IT Governance will perform a simulated phishing attack to determine your organisation’s current susceptibility to this type of attack, identifying the groups of users most at risk.

Our team of penetration testers will come up with a range of phishing scenarios. We use various techniques, but they generally involve sending an email to random, or in some cases nominated, personnel. The email asks the targeted employees to take certain actions that will result in them giving sensitive information such as usernames and passwords. The responses and any information contained within will be intercepted and assessed, while redirecting users to prevent suspicion.

The identified vulnerabilities are presented in a format that allows an organisation to assess the resistance of its employees to a phishing attack.

Your challenge

Phishing attacks are quick and easy to implement and deliver an enormous return on investment, which has motivated criminals to create increasingly sophisticated and creative phishing ‘lures’. These are often indistinguishable from genuine emails, text messages or phone calls; in general, affected users don’t report the compromise until it is too late, inflicting enormous damage on your organisation. Senior management need regular assurance that staff have been properly trained on how to spot phishing emails, and the only real way to achieve this is through a simulated phishing attack.

Our service offering

• A detailed consultation to identify the depth and breadth of the tests required, with careful scoping of the test environment to establish the exact extent of the testing exercise.
• A range of manual tests conducted by our team of highly skilled penetration testers using a methodology closely aligned with the Open Source Security Testing Methodology (OSSTM).
• A series of wireless surveys of the scoped environment, with automated and manual identification of vulnerabilities.
• Immediate notification of any critical vulnerabilities in order for you to take action quickly.
• A detailed technical report that details the identified vulnerabilities (ranked in order of significance).
• A list of recommended countermeasures to address any identified vulnerabilities.
• An executive summary that explains in business terms what the risks mean

Benefits

A simulated phishing attack allows you to:

• Quickly find out if there is an internal awareness problem;
• Determine who to enrol in training after they fall for an attack – an effective way to change end-user behaviour; and
• Craft campaigns based on the experiences and threat analysis of our expert security testing team.