Our Cybersecurity Awareness Month article series continues with a look at the Week 2 theme for this event - "Fight the Phish". While email phishing attacks are not the only threats to your security, they do represent a sizable number of the breaches we see, and knowing some basic ways to shore up your defenses against these attacks is always a good idea.
OK, so how prevalent is phishing really? This type of attack has been a mainstay in the cybersecurity threat landscape for decades, and people have been cautioned against these attacks for years. You would think that all that training and the years of attention that phishing has received would have severely limited the effectiveness of these attacks, yet 43 percent of cyberattacks in 2020 featured phishing or pre-texting, while 74 percent of US organizations experienced a successful phishing attack last year alone. That means that phishing is one of the most dangerous “action varieties” to an organization’s cybersecurity health. As a result, the need for proper anti-phishing hygiene and best practices is an absolute must.
Know the Red Flags
Phishes are masters of making their content and interactions appealing. From content design to language, it can be difficult to discern whether content is genuine or a potential threat, which is why it is so important to know the red flags.
- Awkward and unusual formatting
- Overly explicit call outs to click a hyperlink or open an attachment
- Misspellings or odd phrases
- Time-sensitive messages from someone who haven't heard from in quiet some time
- Offers that sound too good to be true if you only click a link or provide some information
These traits alone do not ensure that an email is a phishing attempt, after all we've all sent emails with a typo in them, but each of these should cause you to be aware of the possibility that the sender is not who they say they are and that something may be amiss with that email.
Verify the Source
Phishing content comes in a variety of ways, however, many phishes will try to impersonate someone you may already know, such as a colleague, service provider or friend, as a way to trick you into believing their malicious content is actually trustworthy. Don’t fall for it. If you sense that something may be out of place or unusual, reach out directly to the individual to confirm whether the content is authentic and safe. If not, break-off communication immediately and flag the incident through the proper channels.
This second statement is important. It is critical to know how to spot possible phishing attacks, but it is equally important that you know how your organization wants you to treat these messages. Many companies have a process to report these potential attacks so that your IT team can take appropriate measures. Remember, you may not have fallen for that phish, but others in the company may have. Making IT aware helps them keep everyone safer.
Be Aware of Vishing and Other Phishing Offshoots
As more digital natives have come online and greater awareness has been spread about phishing, bad actors have begun to diversify their phishing efforts beyond traditional email. For example, voice phishing, or vishing, has become a primary alternative for bad actors looking to gain sensitive information from unsuspecting individuals. Similar to conventional phishing, vishing is typically executed by individuals posing as a legitimate organization, such as a healthcare provider or insurer, and asking for sensitive information. Simply put, it is imperative that individuals be wary of any sort of communication that asks for personal information whether it be via email, phone or chat. This is especially true if the communication is unexpected. If anything seems suspicious, again, break-off the interaction immediately and contact the company directly to confirm the veracity of the communications.
Phishing may be “one of the oldest tricks in the book,” but it is still incredibly effective. And although it may be hard to spot when you may be in the midst of a phishing attempt, by exercising caution and deploying these few fundamentals, individuals and organizations more broadly can drastically mitigate the chances of falling victim to a phishing attack.
