How to protect against Phishing
You could be one click away from a disaster…
Cybersecurity is one of the most significant issues facing business today. One of these forms of cyber threat is known as Phishing.
What is Phishing? It’s a way to steal confidential information by sending fraudulent messages, often by email. As hackers turn to more elaborate social engineering schemes and deceptions, recognising the threat, before it’s too late, is a challenge in itself.
According to ACC ScamWatch, Australian’s have lost more than $10 million dollars to attacks on personal information (phishing) in 2018.
This figure is much higher when you include losses to businesses and other types of scams.
Who’s the target?
Individuals
Individuals are often targeted through masking as a known brand, with the aim of collecting personal or financial information, such as account credentials, personal identification, and other sensitive information.
Employees
Elaborate and targeted messages, known as ‘spear phishing’, target specific people within organisations, containing personal information to make them appear more authentic. These can be hard to detect, making them extremely dangerous to any organisation.
CEOs
Often referred to as ‘whaling’, an email is sent to a high profile leader, such as the CEO, whereby the criminal is acting as another staff member within the organisation. The goal is to action certain things, such as approving a money transfer to an account or downloading malware such as ransomware.
Make your team aware: Hackers are becoming more sophisticated in their methods.
Examples of email phishing
#1 ANZ
URL’s to action a payment…This looks fishy!
^ How to spot the threat:
This is a simple attempt, masked as ANZ and directed to an individual. Let’s break it down:
The email address that it claims it is coming from has a .com.auu extension which doesn’t exist.
The email is being sent from a Russian domain extension: zimbra.cbdd.spb.ru.
When hovering over the link, it displays a domain extension (.co.th) from Thailand.
Outlook is all-ready suspicious, therefore it’s been placed in the junk mail folder.
Update — March 2019: Look out for the latest ANZ Banking Scam. #2 Microsoft
Microsoft products are popular targets for luring businesses.
^ How to spot the threat:
There’s no reply address
The email isn’t personalised — Dear Office 365 Client — Surely they know your name if you have a subscription with them!?
The link says http://quota.microsoftonline.com which is legitimate, but upon hovering over the link, we see that it is trying to send us somewhere else — http://colexo.org < Dodgy.
Cybersecurity is one of the most significant issues facing business today.
Top Three Steps To Protect Against Email Phishing
There are many ways to protect yourself, your employees and your business. However, these are the top three:
Antivirus with web filtering
Most phishing attacks attempt to exploit vulnerabilities in software, so keeping your antivirus up-to-date will reduce the likelihood of a breach. A good antivirus solution will also incorporate a web filter to verify sources automatically.
Two-factor authentication on email access
Turning on two-step verification adds an additional layer of security for companies and helps protect your accounts from phishing attacks. Better yet, put two-factor on everything that is valuable.
Education around identification
Some businesses receive a number of phishing attempts every day. Therefore, it’s worth investing in training for your employees to understand what looks suspicious or uncharacteristic. It’s important to embrace even false alarms and encourage staff to continuously question suspicious attempts in the future.
Train employees and executives to think with a security mindset and ask questions.
Check reply-to email address and validate that it’s legitimate.
Call to confirm unusual or urgent requests.
✉️ If you have an email that looks fishy, forward it to: thislooksdodgy@shadowsafe.com.au
We’ll check it for you - for free!
PS — If you’re a ShadowSafe client, we protect you with a managed antivirus product that has advanced web filters to weed out known phishing threats.
This is an important issue in cybersecurity, so we’ll continue to write more on this topic. Please share this story with your friends and stay alert.
Regards,
James Bartrop - Director of ShadowSafe