Case Study: A Municipality In Nordic

Our client, a Municipality based in Nordics collaborated with us to maximize its ability to protect its employees against PHISHING attacks.

Client

Our Client – a Municipality based in Nordic is a government body. It provides 360° citizen services, including infrastructure, utilities, town planning, and various critical technical services.

Background

Our Client is a custodian of critical citizen data for personal, health, and benefits and a provider for essential services. Citizen data with the client was at risk with a rise in Phishing attacks.

Stay protected

Business Imperative

Since these sophisticated attacks are rooted in technology and social engineering fabric, employees in an organisation remain vulnerable to Phishing. Our client identified this as its weakest link in the digital security ecosystem. Hence, it aimed at strengthening its first line of defence and set towards empowering the employees with knowledge and information to make better security decisions as part of the risk mitigation strategy.

Tech AGRIM Solution

We carried out wider, in-depth assessments and simulations for various Phishing attack categories and presented them with real-time threat assessments. As part of mitigation planning, user training was conducted to establish effective identification and reporting of cybersecurity threats to the digital security teams. Aware platform was selected as the remedial solution to leverage cutting-edge features consolidated in one single platform. The configurable modules requiring limited technical knowhow were backed by our extensive domain experience. They were also integrated with world class e-learning and gamification modules designed to strengthen the user base. Loaded with a manageable dashboard, the Municipality could now roll-out waves of automated Phishing campaigns in minimal time and with minimal planning. The detailed reporting dashboard provides real-time security awareness and compliance status for each department. This enables them to effectively prioritize, analyse, and act in time for any future encounters with Phishing threats

1. Phishing Simulation & Training Services Approach

1. Assessment

2. Setup Campaign

3. Monitor Results

4. Identify

5. Implementation & Training

2. Multi-layered Defence Approach Against Phishing Attacks

Layer 1 Safeguarding users from attackers

Anti-spoofing controls
Information control – website & social media
Filter/block phishing emails

Layer 2 Enabling users to identify & report phishing emails

Training to spot phishing mails – not 100% foolproof though
Process review: Enable fraudulent request recognition
Supportive environment: Quick reporting, useful feedback, no blame culture

Layer 3 Protect organisation from effects of undetected phishing mails

Accounts protection: Stranger authentication (like 2FA), need based access
User protection: Proxy servers & up-to-date browser
Device protection: Protect against malware

Layer 4 Prompt response to incidents

Well-defined, well-rehearsed incident response plan – covering all types of incidents
Quick incident detection by encouraging reporting of suspicious activity