I'm a public-sector network administrator dealing with repeated phishing incidents. Employees are surrendering passwords and two-factor authentication codes, after which attackers take over their accounts and use them to send more phishing messages to colleagues. We already provide security training, warnings, meetings, and simulated phishing exercises, but some users continue to fall for attacks. Our environment uses Google-hosted email, on-premises Active Directory, and Microsoft identity and administration tools. What technical controls, policies, or processes have actually helped reduce these compromises?
4 Answers
Training and simulated phishing still have a role, but repeated failures need a documented management process rather than endless reminders. Make the exercises realistic, provide immediate follow-up training, and track repeat incidents. Work with HR and leadership on proportionate consequences or additional restrictions, while avoiding a culture that discourages people from reporting mistakes. If disciplinary action isn’t possible, place repeat offenders in a higher-protection group with stricter sign-in policies and limited access, and escalate the risk formally to management.
Require work accounts to sign in only from enrolled or managed devices wherever practical. Conditional access policies can block logins from unknown devices and limit what personally owned phones or computers can access. That way, even if someone gives away a password and MFA code, the attacker has a much harder time using the account. This may require leadership approval, especially in organizations that allow broad BYOD access, but it provides a major security benefit.
Layer prevention and detection so one mistake doesn’t become a full incident. Improve mail filtering, configure DKIM and DMARC appropriately, block suspicious URLs and attachments, and provide a simple report-phishing button with quick human or automated feedback. Centralized audit logs and SIEM or identity detection tools should alert on unusual sign-ins, forwarding rules, mass mail delivery, and other takeover indicators. Automating session revocation and account lockdown can greatly reduce the time spent chasing compromised accounts.
A stronger filtering platform can help a lot because users can’t click what never reaches their inbox. It’s worth presenting the cost of better filtering and automated remediation to management alongside the labor and disruption caused by every account takeover.
The biggest improvement usually comes from treating this as an identity-control problem rather than a training problem. Move users to phishing-resistant authentication such as FIDO2 security keys or passkeys. Adversary-in-the-middle kits can relay passwords and ordinary MFA codes in real time, but passkeys are bound to the legitimate site and generally won’t authenticate through the attacker’s proxy. Also block legacy authentication, revoke sessions after a suspected compromise, restrict risky OAuth grants, and monitor for malicious mailbox rules.
That’s the concern I have too: even employees who normally know what to look for can be fooled by a convincing, timely message. Controls that make the stolen credentials useless are more dependable than expecting everyone to identify every attack.
The challenge in public-sector environments is getting funding for enough managed devices, especially for staff who work remotely. Even partial enforcement for higher-risk applications and administrative accounts would still be useful.