SANS Assessment of Student Learning Plan (ASLP) Security Awareness Training

What should you do if you suspect an email is a phishing attempt?

1. Ignore and delete it

2. Forward it to a colleague

3. Click the links to verify

4. Report it to your IT department

The correct answer is: Report it to your IT department

Reporting the suspected phishing email to your IT department is the most appropriate action to take. When you suspect an email might be a phishing attempt, it’s crucial to escalate the issue to a professional team that can investigate the matter further. The IT department typically has the tools and capabilities to analyze the email, determine its legitimacy, and take necessary actions to protect the organization's network and its users. By involving professionals, you help enhance security protocols and potentially prevent other employees from falling victim to the same phishing attempt. This approach also fosters a culture of security awareness within the organization. Encouraging employees to report suspicious emails strengthens the collective ability to detect and respond to threats, mitigating risks associated with cyber attacks. Ignoring and deleting the email does not address the potential threat and leaves the possibility open for attackers to succeed if others encounter the same email. Forwarding it to a colleague could inadvertently spread the malware or phishing attempt if they open it. Clicking on links to verify the email's legitimacy is particularly dangerous, as it can lead to unintentional malware downloads or exposure of sensitive information. Therefore, reporting to the IT department stands out as the most responsible and effective response.