1. Reporting Phishing Incidents Heather Kimley June 13, 2012

2. Agenda  Reporting Spam/Phishing Incidents  Submitting as an Attachment  Actions by NOMAD for Phishing Issues  Actions by SOC for Phishing Issues  Final Notes

3. Where to Report Phishing Incidents  Send suspected spam to spam@nasa.gov or to the "Spam Administrator" in the GAL.spam@nasa.gov  Recipient of message is NOMAD Team.  All messages should be submitted as an attachment to preserve as much of the original message header information as possible.  Do not simply “forward” the spam email

4. Submitting as an Attachment Outlook:  Open a new message  Use the Insert/Item option to attach the spam, or drag & drop the spam message into the new message  Send the message to the Spam Administrator Entourage:  Open up a new message  Drag & drop the spam message into the new message.  Send the message to the Spam Administrator Thunderbird:  Highlight the spam message  Select View/Headers/All  Forward the message to the Spam Administrator (Thunderbird Users: Do not use the “forward as an attachment” option. That method does not include needed header information.)

5. Actions by NOMAD for Phishing Issues  Validate recipient is a NOMAD user  Contact the SOC at soc@nasa.govsoc@nasa.gov  Block the sender at the NPFs if requested by the SOC  Put block in place on ProofPoint  Determine the number of users who received phishing message if requested by the SOC  Remove message from user inboxes if requested by the SOC Note: NOMAD does not contact the SOC about regular spam email

6. Actions by SOC for Phishing Issues  Block URL at the firewall (prevent users who click the link in the message from reaching the phishing Website)  Send outreach notice (if deemed necessary) Note: If the SOC becomes aware of a phishing incident first, they will contact NOMAD.

7. Final Notes  Messages containing threats, requesting information (e.g. IP addresses) or are abusive (to you or NASA) should be sent to abuse@nasa.govabuse@nasa.gov  The SOC receives emails sent to abuse@nasa.govabuse@nasa.gov  For more information including detailed examples of the difference between spam, phishing and abusive emails, go to: http://nomadinternal.nasa.gov/nomad/nomadspamserv.html http://nomadinternal.nasa.gov/nomad/nomadspamserv.html