A company has noticed multiple instances of proprietary information on public websites. It has also observed an increase in the number of email messages sent to random employees containing malicious…

An additional firewall addresses network perimeter security but does not specifically mitigate phishing attacks, which rely on user interaction with malicious content rather than direct network intrusion.

A redundant email server improves availability and fault tolerance but does nothing to filter or reduce malicious emails reaching employees, making it irrelevant to phishing risk reduction.

Blocking personal email on corporate systems removes a significant phishing vector, as attackers frequently target personal email accounts with malicious links and attachments that employees may open on corporate devices, bypassing corporate email filtering controls entirely.

Updating X.509 certificates on the corporate email server relates to email encryption and authentication integrity, but does not prevent employees from receiving or clicking on phishing emails.

Prohibiting access to social media websites reduces the reconnaissance data available to attackers for crafting targeted spear-phishing campaigns, and also prevents employees from inadvertently posting proprietary information that has already been observed on public websites.

Reviewing file server access violations is a detective control useful for identifying a breach after it occurs, but it does not proactively reduce the risk of employees falling victim to phishing attacks.