saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 16:40:24 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/performing-phishing-simulation-with-gophish/references/standards.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

2.7 KiB
Raw Blame History

Standards & References: Phishing Simulation with GoPhish

Legal & Compliance Framework

  • Computer Fraud and Abuse Act (CFAA): Ensure written authorization before conducting simulations
  • GDPR (EU): Data protection requirements for handling employee email addresses and click data
  • CCPA (California): Employee data privacy considerations
  • Company Acceptable Use Policy: Must align simulation with organizational policies

Industry Standards

  • NIST SP 800-50: Building an Information Technology Security Awareness and Training Program
  • NIST SP 800-16: Information Technology Security Training Requirements
  • SANS Security Awareness Maturity Model: Five levels from non-existent to metrics framework
  • ISO 27001:2022: A.6.3 - Information security awareness, education and training

MITRE ATT&CK References

  • T1566.001: Phishing: Spearphishing Attachment
  • T1566.002: Phishing: Spearphishing Link
  • T1598: Phishing for Information
  • T1204.001: User Execution: Malicious Link
  • T1204.002: User Execution: Malicious File

GoPhish Technical Reference

API Endpoints

Endpoint Method Description
/api/campaigns/ GET List all campaigns
/api/campaigns/ POST Create new campaign
/api/campaigns/{id} GET Get campaign details
/api/campaigns/{id}/results GET Get campaign results
/api/campaigns/{id}/summary GET Get campaign summary
/api/templates/ GET/POST Manage email templates
/api/pages/ GET/POST Manage landing pages
/api/smtp/ GET/POST Manage sending profiles
/api/groups/ GET/POST Manage user groups
/api/import/email POST Import email template
/api/import/site POST Import/clone website

Campaign Event Types

Event Description
Email Sent Email delivered to target
Email Opened Tracking pixel loaded
Clicked Link User clicked phishing URL
Submitted Data User entered credentials
Email Reported User reported via plugin

Phishing Simulation Best Practices

  1. Always obtain written authorization from executive management
  2. Coordinate with IT/security teams to whitelist simulation infrastructure
  3. Start with easier-to-identify phishing and increase difficulty gradually
  4. Never punish employees for failing - focus on education
  5. Provide immediate training after user interaction
  6. Run campaigns regularly (monthly/quarterly) for sustained awareness
  7. Vary scenarios across campaign types (credential harvesting, attachment, link)
  8. Respect opt-outs where legally required
  9. Protect campaign data - treat click/submit data as sensitive
  10. Report metrics anonymously when possible at department level