User awareness matters, but a security program should not make one person the final control between a convincing message and a compromised identity or device. Administrators can reduce opportunity, make reporting easier, and limit the value of a successful deception.
\n\nWhat the joint guidance covers
\nSource fact: CISA, NSA, FBI, and MS-ISAC address phishing used to obtain login credentials and phishing used to deploy malware. Their publication provides recommendations for network defenders and software manufacturers, recognizing that user training, technical protections, and secure product design have related responsibilities.
\nSource fact: The guidance explains that weaker multifactor methods can still be phished or abused. It identifies FIDO- and public-key-infrastructure-based authentication as phishing-resistant approaches. It also describes risk from push approval without number matching, repeated approval prompts, and SMS or voice methods.
\nSource fact: The agencies recommend a standard user-awareness program and prompt incident reporting. Reporting supports faster investigation and can help defenders identify related messages, destinations, credentials, or devices.
\n\nDesign layered controls around real attack paths
\nDSE recommendation: map credential and malware delivery through email, SMS, voice, collaboration, social media, third-party applications, QR codes, attachments, links, and browser prompts. Record which identity, mail, web, endpoint, device, application, and recovery controls can interrupt each path.
\n- \n
- Prioritize phishing-resistant authentication for administrators and high-impact resources, then expand by user, device, and application readiness. \n
- Use current platform guidance to configure message authentication, anti-phishing, impersonation, attachment, link, web, application, macro, and endpoint protections appropriate to the environment. \n
- Provide a one-action reporting method in the tools people use and route submissions to a monitored response workflow. \n
- Preserve original message, headers, sender, recipient, timestamps, URLs, attachments, identity events, device telemetry, and user observations where available. \n
- Test reporting, filtering, detections, triage, containment, and communications with authorized safe scenarios. \n
Respond to suspected success, not just the message
\nDSE recommendation: when interaction may have occurred, validate the user through an independent channel and investigate the identity, sessions, device, mailbox or application rules, privileges, related recipients, and accessed resources. Contain affected identities and devices proportionately, revoke unauthorized sessions, preserve evidence, remove persistence, and correct the failed controls. Deleting the original message alone cannot establish containment.
\n\nApplicability and limits
\nPhishing techniques and product controls change. No filter, training program, authentication method, or vendor claim blocks every attack. Implementation steps must come from current supported platform documentation and be tested for business impact. FIDO and PKI deployments also require registration, device, recovery, emergency-access, and lifecycle planning. This article provides an administrative control model, not a guarantee or a claim that DSE monitors every reader’s environment.
\n\nOfficial reference
\nPhishing Guidance: Stopping the Attack Cycle at Phase One — joint defender and manufacturer recommendations.
\n