Phishing attacks: the threat to your business and what you can do about it
Phishing attacks are on the rise. Scammers are targeting businesses more than ever with phishing emails and text messages. They're stealing sensitive information, conducting identity theft, spreading malicious code, and worse. These social engineering attacks are efficient and deadly.
The outcome of an attack can bring an unprepared organisation to its knees. So, how can you protect yourself from phishing scams?
How Can You Protect Yourself From Phishing
Phishing attacks are getting more complex and hard-to-detect. Scammers target employees at every level of the business. And all it takes is one lapse in judgement to fall prey to a phishing scam. So how do you protect yourself? In this article, we look at what you need to do:
- Understand how they work and what forms phishing scams take
- Recognise some common telltale indicators of a phishing attack
- Know the risks and consequences of a phishing scam
- Arm yourself with a layered protection strategy
The core of being protected is your team. Phishing attacks work because they prey on human vulnerability. This means your employees could be the gap in your security. Or your best defense. Training them to recognise and prevent phishing attacks are the best way to boost your security.
How do phishing scams work?
The first step is to understand what you're dealing with. Phishing scams are dangerous because they prey on human vulnerability, taking advantage of people's innate good nature and trust, and stealing confidential information under the guise of credibility.
Scammers use seemingly legitimate websites, emails and text messages to send suspicious messages. These intend to steal sensitive information such as passwords, credit card numbers and account numbers.
Some common examples of phishing emails and messages include:
- Emails asking your team to renew a password before it expires.
- Emails about updates to their jobs, asking them to submit personal information. They may also have attachments to download, containing malware.
- Alerts about an online account being deactivated, requiring credit card details for renewal.
- Requests from technical support to install certain software, which is actually malware.
- Emails about services they've paid for recently, claiming credit card information is compromised.
How to recognise phishing attacks
Phishing attacks work because they manage to appear so credible. But there are some telltale phishing indicators your team can look out for in a suspicious email or text message:
- The message has an unfamiliar tone or greeting
- An absence of verifiable information in some claims made
- It's an unsolicited message
- There may be grammar or spelling errors
- The message has an unusual sense of urgency
- The content includes suspicious links or attachments
- It asks for personal data like credit card details
- It's from an odd email address or has a weird phone number
- It includes a ‘do not reply’ note, usually at the end of the email
- It contains an 'unsubscribe' link that actually directs to a fake website.
- Other unusual requests, like taking immediate action on something outside their role
Why phishing attacks are so dangerous
Phishing is an effective social engineering attack because it's done at scale. Scammers target people across your organisation, finding many victims and causing significant damage.
A number of things can happen from a phishing attack:
- Employees follow the requests in a phishing email that result in financial losses
- Employees provide confidential information to the seemingly legitimate source
- Employees follow a suspicious link to a malicious website that carries malware
- Scammers use your sensitive information for identity theft, especially on social media profiles
And so much more. The fallout of all this creates major financial and reputation losses for companies. Affected systems must be shut down, causing costly work disruption. You may get dragged through lengthy legal and insurance hurdles.
How to protect yourself from phishing attacks
When it comes to phishing, awareness in your team is your first line of defence. That's why investing in cyber security training pays major dividends down the road.
Employees that aren't trained in phishing and cyber security are likely to fall victim. They will miss suspicious activity in an email message that looks like it's from a real organisation. Assuming it's a legitimate source, they'll offer up personal details thinking that they're just doing their job. Even the best security software can't prevent errors in human judgement.
So how do you create a well-armed team?
-
Invest in basic cyber security training across the board
No matter the size of your business, all it takes is one lapse in judgement from one person to create a vulnerability. And scammers don't just target big organisations. Cyber security training in phishing attacks should be completed at every level of the organisation. -
Get your team to report suspicious messages
Depending on the email client, there are steps to report suspicious activity in identified phishing emails. This report goes to the email provider to help them learn and update their systems. Employees should also report activity to your IT department and the Anti-Phishing Working Group. -
Use strong passwords
Once malware is in a system, it can be used to hack into online accounts to steal confidential information. Equip your team with the knowledge to build strong passwords that are less likely to be hacked. Password management software and layered authentication processes will also beef up your security. -
Keep your operating systems updated
Keeping your systems up-to-date with the latest security software patches can help filter out malicious code. It will especially block malware delivered through phishing emails and fake websites. -
Regularly review financial statements
You may have already fallen victim to a phishing attack used to steal financial assets. Perhaps a team member unknowingly provided credit card details. Review your financial statements regularly to identify suspicious activity or unfamiliar transfers. -
Back up your data consistently
In case something does happen, you may have to roll back work. Pausing systems, clearing drives, etc to shut down a phishing attack could result in lost data. Unless you have it backed up elsewhere. Routinely backing up your data offers peace of mind if a device is hacked or infected. -
Invest in additional security software
Again, while this won't fix the issue of human error, it doesn't mean you shouldn't invest in more security. Firewalls, anti-virus security software and pop-up blockers create another layer of security between your confidential information and scammers. -
Never respond to suspicious emails
The second someone responds to a scammer, the email address is flagged as active. This opens your team up to further attacks and phishing scams. This personal data can also be shared or sold, encouraging others scammers to target them as well. -
Contact the company that was impersonated
Sometimes phishing emails get really close to the truth by impersonating legitimate companies. It's important to prevent the spread of a scam by letting them know so their team and customers don't fall prey to the same phishing attack. -
Invest in phishing simulations
Phishing attack simulations are conducted by legitimate companies that design fake phishing emails and pretend to be scammers. This allows you to run a controlled test across your organisation and identify people likely to fall for the real thing, or determine the types of content that will more likely trick your team. From there you can tailor your anti-phishing training to cover specific gaps.
Need some help protecting yourself?
Getting your entire organisation ready to defend against phishing attacks is a big task. From cyber security training to updating ICT policy and conducting regular phishing simulations, there's a lot to do.
At CyberSafe we specialise in end-to-end cyber security solutions. Whether it's getting your team trained or testing their security knowledge, we've got your back. Speak to one of our cyber security experts to see how we can help you.
