语音钓鱼、短信钓鱼与借口伪装

# Common vishing pretexts:
# 'This is the IRS. You owe back taxes; pay now to avoid arrest'
# 'Microsoft Support detected a virus on your computer'
# 'Your bank account is compromised; verify your PIN to secure it'
# 'Social Security Administration: your number has been suspended'
#
# Red flags:
# - Caller ID can be spoofed (not proof of legitimacy)
# - Legitimate orgs do NOT call demanding immediate payment or credentials
# - Urgency + threats of arrest/account closure are common manipulation

# Smishing message examples:
# 'USPS: Your package is held. Confirm your address: bit.ly/xYz123'
# '[BANK]: Suspicious charge of $499. Verify: yourbank-security.com'
# 'Free iPhone 16 winner! Claim now: apple-promo-2026.net/claim'
#
# Technical defenses:
# - Mobile threat defense (MTD) solutions scan SMS links
# - DMARC does NOT protect SMS (different channel)
# - Carrier-level SMS filtering for known smishing patterns
# - User training: never click SMS links for financial matters

# Pretexting example scenarios:
# IT helpdesk: 'I'm the new IT contractor and need your temp
#   password while your account is being migrated.'
# Vendor: 'I'm from the HVAC company doing scheduled maintenance.
#   I need access to the server room.'
# Executive assistant: 'My CEO needs the quarterly report on Slack
#   right now; please send it directly to him at this number.'
#
# All rely on a believable false role to justify an unusual request

# Help desk identity verification procedure:
# 1. Employee initiates account reset via SELF-SERVICE portal first
# 2. If phone call required: verify with manager callback (not to number provided by caller)
# 3. Out-of-band verification: employee must present to IT desk in person for high-privilege resets
# 4. Automated OTP sent to MANAGER for approval before reset
# 5. Log all password resets and alert SIEM on after-hours resets
# NEVER bypass verification for urgency

# SIM swap defense measures:
# User-side:
#   - Set a carrier-level PIN/passcode (separate from account password)
#   - Use app-based TOTP instead of SMS-based MFA where possible
#   - Use hardware security keys (FIDO2) — not tied to phone number
#   - Freeze/lock your SIM with carrier ('number lock' or 'port freeze')

# Organization-side:
#   - Never use SMS OTP for high-value account recovery
#   - Use FIDO2 security keys for employee accounts

# Reporting and detection workflow:
# 1. Employee receives suspicious call/text
# 2. Reports via: phishing@company.com or helpdesk ticket
# 3. SOC reviews: was any account action taken?
#    - Check AD logs for password changes/unlocks
#    - Check SIEM for account access changes post-call
# 4. If social engineering succeeded:
#    - Immediately reset affected credentials
#    - Review all actions taken by the compromised account
#    - Alert affected systems and downstream services