Module 11 · Email Security & Phishing Triage

Last updated: April 29, 2026

Why this module exists. Email is still the primary initial-access vector in 2026. Verizon DBIR: ~30% of breaches start with phishing. Modern phishing is sophisticated (AI-generated content, MFA-aware), and email-security tools have advanced (sandboxing, behavioural detection, DMARC enforcement). Defenders who haven’t kept pace have a 2018-grade email defence.

The four phishing variants you’ll see

• Bulk phishing — credential-harvest pages, mass-distributed. AI has made these visually convincing. Detection: known-bad URL lists, sandbox analysis.
• Spear phishing — targeted, often impersonating executives or vendors. Personalised content, fewer spelling errors. Detection: behavioural (sender reputation, header anomalies).
• BEC (Business Email Compromise) — vendor impersonation, often invoice fraud. Plain-text emails, no malicious links — pure social engineering. Detection: vendor-baseline anomaly + human review.
• Account takeover — attacker has compromised an internal mailbox; sending from inside. DMARC won’t help because the email IS legitimate. Detection: behavioural anomaly inside the mailbox.

The DMARC + SPF + DKIM trinity

SPF says “these IPs can send email for my domain.” DKIM signs email content with the domain’s private key. DMARC ties them together with a policy: p=none (monitor only), p=quarantine (junk-folder), p=reject (reject outright).

Implementation pattern:

1. Inventory all senders for your domain (your own mail, marketing platforms, support tools, vendor notifications). 30-50 typical for an enterprise.
2. Add each to SPF + DKIM.
3. Start with p=none + DMARC reports to your SIEM. Watch for legitimate senders being marked-fail.
4. After 30-90 days clean reports, move to p=quarantine; pct=25.
5. Gradually ramp pct: 25 → 50 → 100.
6. Move to p=reject when confident.

Most Indian enterprises in 2026 are at p=quarantine; only ~30% have reached p=reject. The journey is slow because the inventory is hard.

What DMARC doesn’t stop

• Lookalike domains (ringsa f e.in, ringsafe.co, etc.) — DMARC protects YOUR domain only.
• Display-name spoofing (sender name = “CEO” but email = [email protected]) — many email clients show only the display name.
• BEC where the attacker uses a legitimate but compromised mailbox.
• Internal phishing (account takeover then send from inside).

Sandboxing — what modern email security adds

Microsoft Defender for Office 365, Proofpoint, Mimecast, Barracuda — all run attachments and URLs in sandboxes before delivery. Catches:

• Macros that execute commands
• HTML attachments that ferry to credential-harvest pages
• URLs that redirect to known-malicious sites
• Office documents with embedded payloads

Coverage is 90%+ on commodity threats; less reliable on targeted, novel campaigns.

The phishing-report → triage pipeline

Goal: easy reporting + fast triage + closed-loop feedback to user.

1. Report button in Outlook/Gmail — every employee, one click. PhishER, KnowBe4, native Office button.
2. Auto-collected report — SOAR playbook ingests; extracts URL/attachment/headers.
3. Automated analysis — sandbox URLs and attachments; check sender reputation; check for similar emails in other inboxes.
4. Triage decision — confirmed malicious → mass-delete from all mailboxes, block sender, alert IR if any user clicked. Confirmed benign → close.
5. User feedback — within 24h, user receives “you were right / it was clean” so they keep reporting.

BEC playbook — the human-in-loop scenario

BEC emails have no technical malware. Detection signals:

• External sender claiming to be internal executive
• Bank-account change request
• Urgency / out-of-band (“I’m in a meeting, just process it”)
• Reply-to address differs from From
• Display name impersonation

SOAR / email gateway can flag and quarantine. Final decision usually requires human review + finance team callback to the supposed sender on a known-good number.

Real-world cases

• Indian companies lose ₹100s of crore yearly to BEC — invoice-fraud variant.
• 2023-25 surge in MFA-aware phishing using EvilGinx-style proxy phishing kits.
• 2024 OAuth consent phishing increasingly bypasses traditional email filters.

Defender’s checklist

• DMARC at p=quarantine or p=reject on every domain you send from. DMARC reports ingested into SIEM.
• Sandboxing on inbound email — Defender for Office, Mimecast, or equivalent.
• Phishing-report button deployed; SOAR playbook for triage.
• Lookalike-domain monitoring — register obvious typos; watch CT logs for new lookalikes.
• BEC detection rules — finance-routing pattern detection.
• User training with realistic simulations. KnowBe4, Cofense, or in-house. Quarterly minimum.
• MFA-aware phishing detection — alert on proxy-phishing patterns (TLS handshake fingerprints, Cloudflare proxy patterns common to EvilGinx).