What are the most important metrics to track for phishing incidents?

Definition: Keep an eye on the overall quantity of phishing incidents targeting your organization. Significance: A rise in phishing volume may indicate an increased threat level. Action: Regularly assess and analyze the number of reported and blocked phishing attempts. Impact: Enables timely response and adjustments to security measures to counteract phishing campaigns effectively.

Phishing attack volume is a big concern. In part because it is intended to trick user(s) into accidentally infecting their computer, etc, by selecting a link. So, if you detect an increase in phishing attacks, then you need to update and advise your staff members what to so. To avoid complacency setting in, with respect to how to correctly identify/ handle phishing attacks. You also need to ensure staff are aware of the steps to take, if they accidentally click on a phishing email link. You should also use the increased phishing attack volume to drive a review of your security monitoring, handling processes, etc. To ensure you can act quickly, with respect to any perceived 'successful' phishing attack.

Some phishing can be left in employee inboxes without them ever seeing them. I would urge caution on the confidence of using volume of phishing received and the number that reported or opened or clicked etc. Metrics shoud be reliable and we are getting into metametrics now. One way to measure this more accurately could be using your LMS as part of the Awareness Program if you are sending phishing simulations from there. Sometimes these can give you insights into the number of emails opened by including a pixel within that email.

Definition: The percentage of phishing emails that successfully bypass security measures and reach users' inboxes. Significance: Indicates the effectiveness of your email security controls in filtering out malicious emails. Action: Monitor the ratio of phishing emails detected versus those that slip through the filters. Impact: Helps identify weaknesses in email security defenses and informs adjustments to improve detection and prevention mechanisms. A lower phishing rate suggests better protection against email-based threats.

Having this kind of metric can help you better understand what kind of emails are getting blocked by your systems. Hence, you can use those results to setup and enhance the efficiency on other systems by adding it to certain parameters.

Email Filtering: Implement advanced email filtering solutions. Multi-Factor Authentication (MFA): Enable MFA for enhanced account security. Regular Software Updates: Ensure prompt software updates for security patches. URL Inspection: Use tools to scan and block suspicious links in emails. Security Awareness Campaigns: Run periodic campaigns to reinforce security practices. Incident Response Plan: Develop and test a comprehensive incident response plan.

Sometimes it can be difficult for small businesses to invest into security measures that tracks and classify all new emails that comes on their inbox. Therefore, they might not know what they should look for to determine if an email is phishy. But there are great metrics that everyone can collect to further analyze into a software. You must visit the advanced options to have access to the headers. From there, you will be able to find the SPF, DMARC and DKIM score which gives you a good indication of the trustiness of an email and the source it comes from.

Remember all your staff need to have some understanding of how to respond to a phishing attack. Normal staff members need to know what to do, if they believe their computer has been affected by a phishing attack. Support/ Operations/ Security staff need to know what to do to contain, monitor, redress phishing attacks, etc. Including meeting legal requirements to report the attack, etc. In addition to having effective monitoring or such attacks, you also need to understand how to contain the impact of the attack. Particularly at the infrastructure level. You also need to be able to investigate the attack to understand what its potential target(s) objective(s) are. So just 'turning of the impacted computer' is not a viable approach.

Delving into phishing victimology is also essential, as it uncovers recurring targets and offenders, unveiling patterns and focal points for scrutiny. By analyzing victim behavior and attacker strategies, organizations can bolster their defenses and preemptively address future threats.