mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
59 lines
2.7 KiB
Markdown
59 lines
2.7 KiB
Markdown
# Standards & References: Phishing Simulation with GoPhish
|
|
|
|
## Legal & Compliance Framework
|
|
- **Computer Fraud and Abuse Act (CFAA)**: Ensure written authorization before conducting simulations
|
|
- **GDPR (EU)**: Data protection requirements for handling employee email addresses and click data
|
|
- **CCPA (California)**: Employee data privacy considerations
|
|
- **Company Acceptable Use Policy**: Must align simulation with organizational policies
|
|
|
|
## Industry Standards
|
|
- **NIST SP 800-50**: Building an Information Technology Security Awareness and Training Program
|
|
- **NIST SP 800-16**: Information Technology Security Training Requirements
|
|
- **SANS Security Awareness Maturity Model**: Five levels from non-existent to metrics framework
|
|
- **ISO 27001:2022**: A.6.3 - Information security awareness, education and training
|
|
|
|
## MITRE ATT&CK References
|
|
- **T1566.001**: Phishing: Spearphishing Attachment
|
|
- **T1566.002**: Phishing: Spearphishing Link
|
|
- **T1598**: Phishing for Information
|
|
- **T1204.001**: User Execution: Malicious Link
|
|
- **T1204.002**: User Execution: Malicious File
|
|
|
|
## GoPhish Technical Reference
|
|
|
|
### API Endpoints
|
|
| Endpoint | Method | Description |
|
|
|---|---|---|
|
|
| `/api/campaigns/` | GET | List all campaigns |
|
|
| `/api/campaigns/` | POST | Create new campaign |
|
|
| `/api/campaigns/{id}` | GET | Get campaign details |
|
|
| `/api/campaigns/{id}/results` | GET | Get campaign results |
|
|
| `/api/campaigns/{id}/summary` | GET | Get campaign summary |
|
|
| `/api/templates/` | GET/POST | Manage email templates |
|
|
| `/api/pages/` | GET/POST | Manage landing pages |
|
|
| `/api/smtp/` | GET/POST | Manage sending profiles |
|
|
| `/api/groups/` | GET/POST | Manage user groups |
|
|
| `/api/import/email` | POST | Import email template |
|
|
| `/api/import/site` | POST | Import/clone website |
|
|
|
|
### Campaign Event Types
|
|
| Event | Description |
|
|
|---|---|
|
|
| Email Sent | Email delivered to target |
|
|
| Email Opened | Tracking pixel loaded |
|
|
| Clicked Link | User clicked phishing URL |
|
|
| Submitted Data | User entered credentials |
|
|
| Email Reported | User reported via plugin |
|
|
|
|
## Phishing Simulation Best Practices
|
|
1. **Always obtain written authorization** from executive management
|
|
2. **Coordinate with IT/security teams** to whitelist simulation infrastructure
|
|
3. **Start with easier-to-identify phishing** and increase difficulty gradually
|
|
4. **Never punish employees** for failing - focus on education
|
|
5. **Provide immediate training** after user interaction
|
|
6. **Run campaigns regularly** (monthly/quarterly) for sustained awareness
|
|
7. **Vary scenarios** across campaign types (credential harvesting, attachment, link)
|
|
8. **Respect opt-outs** where legally required
|
|
9. **Protect campaign data** - treat click/submit data as sensitive
|
|
10. **Report metrics anonymously** when possible at department level
|