mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-28 04:09:40 +03:00
Initial commit - 611 cybersecurity skills across all subdomains
This commit is contained in:
mukul975
@@ -0,0 +1,58 @@
|
||||
# Standards & References: Phishing Simulation with GoPhish
|
||||
|
||||
## Legal & Compliance Framework
|
||||
- **Computer Fraud and Abuse Act (CFAA)**: Ensure written authorization before conducting simulations
|
||||
- **GDPR (EU)**: Data protection requirements for handling employee email addresses and click data
|
||||
- **CCPA (California)**: Employee data privacy considerations
|
||||
- **Company Acceptable Use Policy**: Must align simulation with organizational policies
|
||||
|
||||
## Industry Standards
|
||||
- **NIST SP 800-50**: Building an Information Technology Security Awareness and Training Program
|
||||
- **NIST SP 800-16**: Information Technology Security Training Requirements
|
||||
- **SANS Security Awareness Maturity Model**: Five levels from non-existent to metrics framework
|
||||
- **ISO 27001:2022**: A.6.3 - Information security awareness, education and training
|
||||
|
||||
## MITRE ATT&CK References
|
||||
- **T1566.001**: Phishing: Spearphishing Attachment
|
||||
- **T1566.002**: Phishing: Spearphishing Link
|
||||
- **T1598**: Phishing for Information
|
||||
- **T1204.001**: User Execution: Malicious Link
|
||||
- **T1204.002**: User Execution: Malicious File
|
||||
|
||||
## GoPhish Technical Reference
|
||||
|
||||
### API Endpoints
|
||||
| Endpoint | Method | Description |
|
||||
|---|---|---|
|
||||
| `/api/campaigns/` | GET | List all campaigns |
|
||||
| `/api/campaigns/` | POST | Create new campaign |
|
||||
| `/api/campaigns/{id}` | GET | Get campaign details |
|
||||
| `/api/campaigns/{id}/results` | GET | Get campaign results |
|
||||
| `/api/campaigns/{id}/summary` | GET | Get campaign summary |
|
||||
| `/api/templates/` | GET/POST | Manage email templates |
|
||||
| `/api/pages/` | GET/POST | Manage landing pages |
|
||||
| `/api/smtp/` | GET/POST | Manage sending profiles |
|
||||
| `/api/groups/` | GET/POST | Manage user groups |
|
||||
| `/api/import/email` | POST | Import email template |
|
||||
| `/api/import/site` | POST | Import/clone website |
|
||||
|
||||
### Campaign Event Types
|
||||
| Event | Description |
|
||||
|---|---|
|
||||
| Email Sent | Email delivered to target |
|
||||
| Email Opened | Tracking pixel loaded |
|
||||
| Clicked Link | User clicked phishing URL |
|
||||
| Submitted Data | User entered credentials |
|
||||
| Email Reported | User reported via plugin |
|
||||
|
||||
## Phishing Simulation Best Practices
|
||||
1. **Always obtain written authorization** from executive management
|
||||
2. **Coordinate with IT/security teams** to whitelist simulation infrastructure
|
||||
3. **Start with easier-to-identify phishing** and increase difficulty gradually
|
||||
4. **Never punish employees** for failing - focus on education
|
||||
5. **Provide immediate training** after user interaction
|
||||
6. **Run campaigns regularly** (monthly/quarterly) for sustained awareness
|
||||
7. **Vary scenarios** across campaign types (credential harvesting, attachment, link)
|
||||
8. **Respect opt-outs** where legally required
|
||||
9. **Protect campaign data** - treat click/submit data as sensitive
|
||||
10. **Report metrics anonymously** when possible at department level
|
||||
@@ -0,0 +1,135 @@
|
||||
# Workflows: Phishing Simulation with GoPhish
|
||||
|
||||
## Workflow 1: End-to-End Campaign Execution
|
||||
|
||||
```
|
||||
Phase 1: Authorization & Planning
|
||||
|
|
||||
+-- Obtain written authorization from management
|
||||
+-- Define campaign objectives and success criteria
|
||||
+-- Select target groups (by department, role, risk level)
|
||||
+-- Choose phishing scenario (credential harvest, link click, attachment)
|
||||
+-- Set campaign timeline
|
||||
|
|
||||
Phase 2: Infrastructure Setup
|
||||
|
|
||||
+-- Deploy GoPhish server (Docker or bare metal)
|
||||
+-- Configure SSL/TLS certificate for landing page
|
||||
+-- Set up SMTP sending profile
|
||||
+-- Whitelist GoPhish IP in email gateway
|
||||
+-- Configure DNS for phishing domain
|
||||
+-- Test email deliverability
|
||||
|
|
||||
Phase 3: Content Creation
|
||||
|
|
||||
+-- Design email template with GoPhish variables
|
||||
+-- Create or clone landing page
|
||||
+-- Set up redirect to training page
|
||||
+-- Configure credential capture (if authorized)
|
||||
+-- Test with internal team first
|
||||
|
|
||||
Phase 4: Target Preparation
|
||||
|
|
||||
+-- Import user list (CSV: first,last,email,position)
|
||||
+-- Segment into groups if needed
|
||||
+-- Verify email addresses are valid
|
||||
|
|
||||
Phase 5: Campaign Launch
|
||||
|
|
||||
+-- Set send schedule (staggered over hours/days)
|
||||
+-- Launch campaign
|
||||
+-- Monitor real-time dashboard
|
||||
+-- Handle any delivery issues
|
||||
|
|
||||
Phase 6: Analysis & Reporting
|
||||
|
|
||||
+-- Wait for campaign duration to complete
|
||||
+-- Export results via API
|
||||
+-- Generate analytics report
|
||||
+-- Present findings to stakeholders
|
||||
+-- Identify high-risk groups for targeted training
|
||||
```
|
||||
|
||||
## Workflow 2: Progressive Difficulty Model
|
||||
|
||||
```
|
||||
Quarter 1: Easy to Detect
|
||||
+-- Generic greeting, spelling errors
|
||||
+-- Unrelated external domain
|
||||
+-- Obvious call to action
|
||||
+-- Expected: < 20% click rate
|
||||
|
|
||||
Quarter 2: Moderate Difficulty
|
||||
+-- Personalized with name/department
|
||||
+-- Look-alike domain
|
||||
+-- Relevant pretext (IT maintenance, HR policy)
|
||||
+-- Expected: < 15% click rate
|
||||
|
|
||||
Quarter 3: Difficult
|
||||
+-- Highly targeted content
|
||||
+-- Convincing sender spoofing
|
||||
+-- Timely pretext (tax season, annual review)
|
||||
+-- Expected: < 10% click rate
|
||||
|
|
||||
Quarter 4: Advanced
|
||||
+-- Spear-phishing with OSINT
|
||||
+-- Multi-step pretext
|
||||
+-- Mimics real vendor communication
|
||||
+-- Expected: < 5% click rate
|
||||
```
|
||||
|
||||
## Workflow 3: Automated Campaign via API
|
||||
|
||||
```
|
||||
[Python Script] --> GoPhish API
|
||||
|
|
||||
+-- POST /api/smtp/ (create sending profile)
|
||||
+-- POST /api/templates/ (create email template)
|
||||
+-- POST /api/pages/ (create landing page)
|
||||
+-- POST /api/groups/ (import target users)
|
||||
+-- POST /api/campaigns/ (launch campaign)
|
||||
|
|
||||
[Wait for campaign duration]
|
||||
|
|
||||
+-- GET /api/campaigns/{id}/summary
|
||||
+-- GET /api/campaigns/{id}/results
|
||||
|
|
||||
[Generate report with metrics]
|
||||
|
|
||||
+-- Calculate: open rate, click rate, submit rate, report rate
|
||||
+-- Compare against baseline and industry benchmarks
|
||||
+-- Export to PDF/HTML report
|
||||
```
|
||||
|
||||
## Workflow 4: Post-Campaign Remediation
|
||||
|
||||
```
|
||||
Campaign Results Available
|
||||
|
|
||||
v
|
||||
[Identify users who submitted credentials]
|
||||
|
|
||||
+-- Immediately: Force password reset
|
||||
+-- Within 24h: Send targeted training content
|
||||
+-- Within 1 week: Manager notification (aggregate only)
|
||||
|
|
||||
v
|
||||
[Identify users who clicked but did not submit]
|
||||
|
|
||||
+-- Send phishing awareness micro-training
|
||||
+-- Include specific red flags they missed
|
||||
|
|
||||
v
|
||||
[Identify users who reported the email]
|
||||
|
|
||||
+-- Send positive reinforcement
|
||||
+-- Recognize in security champions program
|
||||
|
|
||||
v
|
||||
[Aggregate department-level metrics]
|
||||
|
|
||||
+-- Present to leadership
|
||||
+-- Identify highest-risk departments
|
||||
+-- Plan targeted training interventions
|
||||
+-- Schedule next campaign
|
||||
```
|
||||
Reference in New Issue
Block a user