Phishing - 43 Resources

Introduction

Phishing attacks use e-mail or malicious websites to solicit personal, often financial, information. Attackers may send e-mail seemingly from a reputable credit card company or financial institution that requests account information, often suggesting that there is a problem. When users respond with the requested information, attackers can use it to gain access to the accounts.

For more examples of what campuses are doing to combat phishing attacks, visit the Higher Education Information Security Council (formerly the Security Task Force) blog announcement, "Protecting Your Institution from Phishing Attacks: Education and Awareness Resources". Additional materials are being compiled for the Cybersecurity Awareness Resource Library. Contact security-council@educause.edu if you would like to contribute additional resources.

University Websites on Phishing

• Brown University
• Cal Poly Pomona
• Indiana University
• Rochester Institute of Technology
• Tufts University
• University of Delaware
• University of Notre Dame
• University of Wisconsin-Madison
• Webster University
• Yale University

Posters, Brochures, Bookmarks, and Postcards

• Are You Secure (Illinois State University)
• Avoid Getting Hooked by Phishers (National Consumers League)
• Avoiding Identity Theft Online: Detecting Online Scams and Phishing (RIT)
• Be Prepared: Phishing Attacks (Louisiana State University)
• Beware of the Phisher and He Just Made His Biggest Catch...You and (Ohio State University)
• Beware of the Phishing Scam (Indiana University)
• Beware Phishing: Don't Get Hooked (University of New South Wales)
• Don't Let Phishing Scams Reel You In and Phishing: Don't Bite (University of Chicago)
• Technology Quick Start Guide (Illinois State University)

Quizzes and Games

• Carnegie Mellon University's Anti-Phishing Phil Game
• Microsoft Quizzes: Phishing Basics 1 and Phishing IQ Test II
• OnGuard Online Phishing Scams Quiz
• SonicWALL Phishing and Spam IQ Test

Videos

• 2009 Computer Security Awareness Video Contest Winners
• 2007 Computer Security Awareness Video Contest Winners
• 2006 Computer Security Awareness Video Contest Winners

Additional Resources

• FTC Consumer Alert: How Not to Get Hooked by a "Phishing" Scam
• OnGuardOnline.gov's Quick Facts about Phishing
• SANS OUCH!: Security Digest - OUCH! is the first consensus monthly security awareness report for end users. It shows them what to look for and how to avoid phishing and other scams plus viruses and other malware -- using the latest attacks as examples. It also provides pointers to great resources like the amazing Phishing Self-Test.
• Anti-Phishing Working Group - The Anti-Phishing Working Group (APWG) is an industry association focused on eliminating the identity theft and fraud that result from the growing problem of phishing and email spoofing.
• Digital PhishNet - An antiphishing group that includes companies such as Microsoft Corp., America Online Inc., VeriSign Inc. and EarthLink Inc., as well as government agencies such as the FBI, the U.S. Secret Service and the U.S. Postal Inspection Service.
• Avoid Getting Hooked by Phishers! - Internet fraud tips from the National Consumers League's Internet Fraud Watch.
• Phish Report Network - The Phish Report Network (PRN) enables companies to reduce online identity theft by safeguarding consumers from phishing attacks. As the first worldwide anti-phishing aggregation service, the Phish Report Network provides subscribers with a mechanism for staging a united defense against phishing.
• PhishGuru.org - PhishGuru (managed by Carnegie Mellon University) is an email-based anti-phishing training system in which training messages are designed to look like phishing messages. When users "fall" for the messages, this site takes advantage of the "teachable moment" and immediately teaches users how to avoid falling for real scams. PhishGuru effectively teaches people what cues to look for to distinguish scams from legitimate email.
• PhishRegistry.org - PhishRegistry.org is a free resource provided by CipherTrust, Inc. to help businesses know when they are at risk of being phished. PhishRegistry.org monitors the content of a Website and provides notifications of online fraud attempts.
• PhishingInfo.org - PhishingInfo.org shows users how phishing works, how to protect yourself, and where to go for help. It also provides links to research reports and educational materials.
• Microsoft Phishing Filter (for Internet Explorer 7)