There are simple technological remedies and policy changes that companies can make to mitigate some of the risk of revealing sensitive data to phishers.

At the end of the day, however -- since phishing is really a human behavior problem -- training and awareness programs are the most effective ways of fighting back. The scope of these programs need not be particularly broad: all employees should understand how to recognize suspicious e-mail, how to use digital signatures, and how to comply with organizational e-mail policies.

Companies may also want to consider whether the need for training stops with their employees, or whether business partners, vendors, and even customers might benefit from a better understanding of the phishing scam.