How can we make phishing attacks less successful or remove these attack style altogether. 9 times out of 10 when I hear about some major hack its because of phishing.
It's one thing to lock everyone out if you're Booz Allen, but another if you've got journalists on the ground in Cairo competing with Twitter to break news.
The easiest way is to IP limit any services with user privileges.
IP's can be spoofed though, and then you're severely limiting your ability to work flexibly, which doesn't go well for journalists.
Two Factor Auth is another technique that's really coming into it's own now among web systems, but again not super great if someone loses their smartphone or RSA dongle while running from a gunfight and needs to access the system NOW.
I work on the assumption that any password can be compromised at any time, so the system should be able to lock out and roll back a user's edits ASAP, and content-creating users shouldn't be able to get any code executing on the server. Easier said than done with most CMS's though...
As a matter of policy, our team uses LastPass, too, which makes phishing easy to detect; if LastPass doesn't offer to fill your login info, you're not on a legit site. Using LastPass-generated passwords that users can't remember on their own is a marvelous anti-phishing weapon. We also enforce 2FA.
That said, there is no substitute for education.
the undercurrents of misogyny is depressing.
Right now, I'm trying to think of jobs for a news provider that wouldn't require tech savvy. "Secretary" is the only one that comes to mind. Secretaries are stereotypically women.