Phishing
What is Phishing?
A social engineering attack that uses fraudulent emails, text messages, or websites to trick users into revealing sensitive information such as passwords, credit card numbers, or personal data. Phishing remains the most common initial attack vector.
Terms that appear alongside phishing
Each of these is named in at least one of the same controls as phishing. The number is how many controls name both.
- authentication 27 shared controls
- nist 19 shared controls
- multi factor authentication 16 shared controls
- cybersecurity 15 shared controls
- social engineering 12 shared controls
- phishing simulation 11 shared controls
- audit 11 shared controls
- insider threat 10 shared controls
Frameworks that govern phishing
What the standards actually require on phishing
Requirements naming phishing across 6 standards, quoted from the control text.
Multi-factor authentication used for authenticating users of systems is phishing-resistant.
ISM-1682 · Phishing-resistant multi-factor authentication →Multi-factor authentication used for authenticating users of data repositories is phishing-resistant. Required at Maturity Level Three of the Multi-factor authentication mitigation strategy (Appendix C);
acsc-essential-eight::E8-MFA-ISM-1894 · Multi-factor authentication (ISM-1894): Multi-factor authentication used for authenticating users of data repositories is phishing-resistant →Security awareness training must address threats and vulnerabilities that could affect cardholder data or sensitive authentication data, covering at minimum phishing (and attacks related to it) plus social engineering.
12.6.3.1 · 12.6.3.1 Awareness training covers phishing and social engineering →The bank encourages customers to report phishing emails and sites and takes effective remedial action on reports.
rbi-cybersecurity-framework-for-banks::206 · Para 206: encourage customers to report phishing and act on reports →FIDO2 PHISHING RESISTANCE properties + the channel binding + anti-replay + privacy mechanisms. PHISHING RESISTANCE: WebAuthn ceremonies bind the authentication to the ORIGIN (cryptographically verified by the client + RP server);
FIDO2-Phishing-Resistance · Phishing Resistance, Channel Binding, Anti-Replay and Privacy →Implement AAL3 authentication per NIST SP 800-63B Section 4.3. AAL3 requires (a) Multi-Factor Cryptographic Hardware authenticator OR Single-Factor Cryptographic Hardware combined with a memorised secret OR Multi-Factor One-Time Password Device combined with a...
NISTSP63-6 · AAL3 Authentication: Hardware Cryptographic, Verifier Impersonation Resistance, Phishing Resistance →Questions people ask about phishing
What is Phishing?
Why is Phishing important for compliance?
Which compliance frameworks address Phishing?
Where can I learn more about Phishing?
See how Phishing applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.