What defense is suggested for highly targeted phishing (whaling)?

• A. Increasing firewall rules
• B. Using offline backups
• C. Implementing DLP, marking external emails, and training
• D. Replacing all staff

Answer: (C)

Targeted phishing attacks like whaling succeed by exploiting people and the flow of sensitive data. A layered defense that includes data loss prevention, external email marking, and training specifically targets both the technical and human factors involved. DLP helps prevent sensitive information from leaving the organization through email, reducing the potential impact of a successful deception. Marking external emails provides a visible cue that the message did not come from inside the organization, prompting users to verify requests more carefully. Training builds recognition of common whaling tactics—such as impersonation of executives, urgent financial requests, or spoofed sender addresses—and teaches safe verification steps and reporting procedures.

Raising firewall rules focuses on network boundaries and may not stop social engineering that arrives through legitimate channels. Offline backups protect against data loss after a breach but don’t prevent the initial manipulation or data exfiltration. Replacing staff is not a realistic or effective security measure.