It work security team noticed that an increasing number of employees are becoming victims of phishing attacks. Which security program should be implemented to mitigate the problem?

Phishing is a form of social engineering that targets the human element, tricking employees into divulging sensitive information or performing actions that compromise security. While technical controls are part of a defense-in-depth strategy, the most direct and effective program to mitigate successful phishing attacks is user awareness training. This training educates employees on how to recognize the characteristics of phishing emails (e.g., suspicious links, urgent requests, spoofed senders) and what actions to take. By addressing the root cause—human error—organizations can significantly reduce their vulnerability to these attacks.

A. email system patches: Patches address software vulnerabilities, whereas phishing primarily exploits human psychology, not a technical flaw in the email system.

B. physical access control: This secures physical premises and equipment, which is irrelevant to preventing an employee from clicking a malicious link in an email.

C. software firewall enabled on all PCs: A firewall can block malicious connections but does not prevent the user from receiving the phishing email or being deceived by its content.

1. Odom

W. (2019). CCNA 200-301 Official Cert Guide

Volume 2. Cisco Press. In Chapter 22

"Security Fundamentals

" the section on "Mitigating Threats" discusses that user training is a primary method to counter social engineering attacks like phishing.

2. Cisco Networking Academy. (2020). CCNA: Enterprise Networking

Security

and Automation (ENSA) v7.0 Curriculum. Module 3

"Network Security Concepts

" Section 3.4.1

"Best Practices

" identifies user education as a crucial best practice for mitigating social engineering attacks.

3. National Institute of Standards and Technology (NIST). (2003). Special Publication 800-50: Building an Information Technology Security Awareness and Training Program. Section 2.2

"The Importance of Security Awareness and Training

" establishes that a comprehensive training program is essential to help users recognize and respond to threats like phishing.