Technical solutions dubbed "usable phishing protection" usually fail miserably, "education" campaigns only work for a short time before users forget about them and are annoying to your user base. Let's start with some facts about security behaviour and then discuss useful courses of action.
Why phishing is easy
Phishing would be easily avoided if people confirmed the identity of websites they are using. This would require for them to see, and correctly process, passive security indicators, and to correctly identify the URL of the website. Here are some fun facts:
- even we security engineers have trouble validating certificates and don't usually do it; a lot of security indicators don't actually reflect on whether the certificate has the correct CN, expiration date, a CA that is not compromised or expired, and a protocol that is not compromised either. This happens because software doesn't get updated and also because of structural difficulties in dealing with revocation in PKIs.
- good phishing campaigns buy domain names similar to the companies they target, and people might fail to read that the URL is incorrect (1inkedin.com vs linkedin.com)
- phishing sites sometimes buy certificates (e.g. using stolen credit cards)
- really good certificates are super expensive, most websites have crappy ones or ones from dubious CAs, or expired ones
- literally all the certificate warnings you receive in daily use will be false alarms caused by poor certificate management on websites' behalf, unless you're a target population (e.g. China, Iran, users of various proxies and high-value accounts who could get spearhead phishing and active MITM attacks)
Now, does it cost that much to verify the URL and certificate every time? Yes. In fact, it would cost more to the US economy if information workers did that systematically than it costs to let phishing happen. Read So long and no thanks for the externalities for the numbers. The key takeaway is that any solution that requires even a second of attention per website for users is doomed to failed.
Add to this the fact that people get habituated to warnings, and they will soon completely forget to check the website's URL even if you put a big red bold scary warning on your login page. Systematic warnings to rare risks are absolutely useless and actually cause your users to not take you seriously anymore when you really need to warn them. Don't do this.
What to do then?
Firstly you need to take action to make phishing harder to perform and easier to detect, regardless of human behaviour:
- buy all the domain names that look like yours or are a misspelt version of yours; yes, this is expensive
- use multi-factor authentication schemes that resist better to phishing, e.g. sending an authentication code to the client's phone (something a phisher would have trouble doing if they don't know your client's phone number)
- use behavioural metrics to spot and block suspicious login attempts (don't immediately allow connections from a foreign country for a client whom you know has no business there, but understand that this might cause severe disturbance to some of your users and make contingency plans to prevent such disturbance, e.g. manually flag international clients based on behaviour and information you collect at sign-up)
- protect the high-value clients by campaigning against phishing with those and being more strict with suspicious login attempts
- be proactive in identifying phishing campaigns against you (by having dummy user accounts that you expose to dubious sites and that will receive the phishing emails / texts, or by helping your users warn you when they are being phished and reacting quickly) in order to send anti-phishing warnings at the right time
About your ideas
- Big warnings: No.
- Warning at registration time, and campaigns: Meh. This will be less and less efficient over time. Strategic campaigning is what you need to do.
- Policy to blame the users if they don't use a specific form of interaction: No. Of course people will click links, in emails and other sites, or on search engines. They can also be fooled by a proxy or ISP and redirected without you knowing, so don't blame them for just acting normally. It's not nice at all.
