Antiphishing & Verified Communications Rob Bandler March 8, 2016

Agenda Introductions Service Description Value Proposition Metrics Cost Security More information Q&A

Introductions Service owner: Rob Bandler Service manager: Rob Bandler Other service delivery team members: Lillian Isacks Meryl Bursic Shaley DeGiorgio

Service Description Antiphishing (Phishbowl) & Verified Communications http://www.it.cornell.edu/security/phishbowl.cfm https://www.it.cornell.edu/security/verified.cfm Two sites consist of current phishes targeting Cornell and Verified e-mail communications from service providers to community. Verified Communications are protected by NetID. Available to: Faculty, Staff, Instructional Professionals, TSPs, Students, Alumni, Guests No Fee Service Service tier: Two

Value Proposition Value proposition Customer impact Key benefits Available 24/7/365 for quick, easy self service use Current Info– Examples are updated in real time by ITSO No Fee – Can be leveraged by local IT to augment outreach and awareness training Customer impact Reduces successful phishing attacks & Credential Compromise Increases confidence in legitimate Cornell communications Key benefits Legitimate communications recognized, improved impact Feeds awareness and builds positive skeptical user culture Combats credential theft, greatest current threat to IT ecosystem

Metrics FY16 Q2 Quarterly Report Number of antiphishing examples: 30 12,433 page views Number of verified communications:  20 644 page views Availability:  100%

Cost Cost to deliver the service: $20,763* per year ($0.39 per page view) No Fee Service

Security What risks does use of the service mitigate? Credential loss, system compromise Financial loss Reputational harm Poor communication penetration How does the service mitigate risks? Stems credential theft, aids system security Outreach, awareness & cultural change aid Improves legitimate communication penetration

More information Service web page: http://www.it.cornell.edu/cms/security/phishbowl.cfm https://www.it.cornell.edu/security/verified.cfm Service catalog entry: https://catalog.it.cornell.edu/admin/6 Service quarterly report: http://cio.cornell.edu/resources/it-reports-documents-and-presentations/itcornell-quarterly-metrics/antiphishing-and

Questions?