Reporting Phishing Incidents Heather Kimley June 13, 2012

Agenda  Reporting Spam/Phishing Incidents  Submitting as an Attachment  Actions by NOMAD for Phishing Issues  Actions by SOC for Phishing Issues  Final Notes

Where to Report Phishing Incidents  Send suspected spam to or to the "Spam Administrator" in the  Recipient of message is NOMAD Team.  All messages should be submitted as an attachment to preserve as much of the original message header information as possible.  Do not simply “forward” the spam

Submitting as an Attachment Outlook:  Open a new message  Use the Insert/Item option to attach the spam, or drag & drop the spam message into the new message  Send the message to the Spam Administrator Entourage:  Open up a new message  Drag & drop the spam message into the new message.  Send the message to the Spam Administrator Thunderbird:  Highlight the spam message  Select View/Headers/All  Forward the message to the Spam Administrator (Thunderbird Users: Do not use the “forward as an attachment” option. That method does not include needed header information.)

Actions by NOMAD for Phishing Issues  Validate recipient is a NOMAD user  Contact the SOC at  Block the sender at the NPFs if requested by the SOC  Put block in place on ProofPoint  Determine the number of users who received phishing message if requested by the SOC  Remove message from user inboxes if requested by the SOC Note: NOMAD does not contact the SOC about regular spam

Actions by SOC for Phishing Issues  Block URL at the firewall (prevent users who click the link in the message from reaching the phishing Website)  Send outreach notice (if deemed necessary) Note: If the SOC becomes aware of a phishing incident first, they will contact NOMAD.

Final Notes  Messages containing threats, requesting information (e.g. IP addresses) or are abusive (to you or NASA) should be sent to  The SOC receives s sent to  For more information including detailed examples of the difference between spam, phishing and abusive s, go to: