Configure Anti-Phishing

Duration20 minOfferModule Anti-phishing

Objectives

• I know how to enable protection for the entire organization
• I know how to choose between Medium and High severity
• I know how to add and remove a domain from the blacklist
• I know how to give a user different settings from those of the organization
• I know what the user sees in their browser

0 / 5 objectives achieved — check them off as you go through the lesson.

Why It’s Useful

Anti-phishing considers any site that is not registered in your VaultysHub as unknown. The more complete your application catalog is, the rarer the warnings are, and thus taken more seriously. The choice of severity is a trade-off between security and freedom: a warning that can be closed, or a block.

Your Turn

The extension must be installed and connected on the test browser.

1. Go to Configuration, tab Extension, and expand the section Anti-Phishing Protection. → Anti-Phishing
2. Activate the switch Enable Anti-Phishing, and choose Medium in Severity.
3. Open the login page of a site that is not in your catalog: a warning appears over the form, with a Close button. → Anti Phishing on the extension side
4. Switch back to High and reload the page: the warning can no longer be closed.
5. In Blacklist, enter a test domain (for example *.example-phishing.com), then click Add. For this domain, the entire site is blocked, not just the form.
6. Remove this domain with the trash icon.
7. In Users, open the action menu of a user, click on Profile, then on the Extension tab. Activate the switch Anti-Phishing to apply specific settings for them, for example, Medium severity when the organization is set to High.

Severity	On a login form of an unknown site
Medium	Warning that the user can close to continue
High	Permanent warning: impossible to log in

Before switching to High

Complete your application catalog, possibly with the help of the module Shadow IT: its detected applications can be added to the applications, or placed on the blacklist with one click.

Check Your Knowledge

1What is an 'unknown' site for anti-phishing?

2At High severity, what happens on the login page of an unknown site?

3What is the difference between a blacklisted domain and an unknown site?

4Only one collaborator should be able to log in to unknown sites, despite the organization's High severity. How to do it?

Key Takeaways

• Protection relies on your catalog: an absent site is unknown.
• Medium warns, High blocks the form, the blacklist blocks the entire site.
• A user can receive specific settings from the Extension tab of their profile.

Congratulations, you have completed this module. Choose the next one from the à la carte modules.