Stop phishing at the control plane, not only at the inbox

User awareness matters, but a security program should not make one person the final control between a convincing message and a compromised identity or device. Administrators can reduce opportunity, make reporting easier, and limit the value of a successful deception.

What the joint guidance covers

Source fact: CISA, NSA, FBI, and MS-ISAC address phishing used to obtain login credentials and phishing used to deploy malware. Their publication provides recommendations for network defenders and software manufacturers, recognizing that user training, technical protections, and secure product design have related responsibilities.

Source fact: The guidance explains that weaker multifactor methods can still be phished or abused. It identifies FIDO- and public-key-infrastructure-based authentication as phishing-resistant approaches. It also describes risk from push approval without number matching, repeated approval prompts, and SMS or voice methods.

Source fact: The agencies recommend a standard user-awareness program and prompt incident reporting. Reporting supports faster investigation and can help defenders identify related messages, destinations, credentials, or devices.

Design layered controls around real attack paths

DSE recommendation: map credential and malware delivery through email, SMS, voice, collaboration, social media, third-party applications, QR codes, attachments, links, and browser prompts. Record which identity, mail, web, endpoint, device, application, and recovery controls can interrupt each path.

1. Prioritize phishing-resistant authentication for administrators and high-impact resources, then expand by user, device, and application readiness.
2. Use current platform guidance to configure message authentication, anti-phishing, impersonation, attachment, link, web, application, macro, and endpoint protections appropriate to the environment.
3. Provide a one-action reporting method in the tools people use and route submissions to a monitored response workflow.
4. Preserve original message, headers, sender, recipient, timestamps, URLs, attachments, identity events, device telemetry, and user observations where available.
5. Test reporting, filtering, detections, triage, containment, and communications with authorized safe scenarios.

Respond to suspected success, not just the message

DSE recommendation: when interaction may have occurred, validate the user through an independent channel and investigate the identity, sessions, device, mailbox or application rules, privileges, related recipients, and accessed resources. Contain affected identities and devices proportionately, revoke unauthorized sessions, preserve evidence, remove persistence, and correct the failed controls. Deleting the original message alone cannot establish containment.

Applicability and limits

Phishing techniques and product controls change. No filter, training program, authentication method, or vendor claim blocks every attack. Implementation steps must come from current supported platform documentation and be tested for business impact. FIDO and PKI deployments also require registration, device, recovery, emergency-access, and lifecycle planning. This article provides an administrative control model, not a guarantee or a claim that DSE monitors every reader’s environment.

Official reference

Phishing Guidance: Stopping the Attack Cycle at Phase One — joint defender and manufacturer recommendations.