Phishing attacks have gained momentum and currency. These attacks exploit cognitive biases and decision making constructs. They play on human emotions by appealing to the greed, curiosity, trust or anxiety of your employees.

Phishing is fishing for information. The attackers attempt to harvest user names, passwords and credit card details by pretending to be what they are not.  For instance, a Phishing site may pretend to be a Login page of your enterprise web site. If the user enters the user id and password, the same will be captured and reused by the Phishing site to gain access to the database. Browsers and plug-ins contain exploitable vulnerabilities. Phishing emails that send links to websites can entice the user to visit the link. The URL then compromises the browser and machine, and opens it up to exploitation. Email attachments can be used to trick users (typically PDFs and “exe” or “rar” or “jar” files) into exposing their machines to the Phishing site.

How does one combat this type of threat?  Generally, Phishing attacks can be prevented in two ways—training your users and implementing technical security controls.

Security awareness training educates employees and prevents them from indulging in risky activities on the network.  Trained employees will avoid trusting links in an email. They will not give out information upon an email request. They will navigate to the real web address in a new instance of the browser and check out the validity of the email request.  They will ignore the phone numbers given out in the email and check with reliable sources about the contact details provided. Unexpected attachments will be ignored and threats that list consequences of inaction will be regarded with suspicion. Employees will automatically use a two factor authentication system to defeat the phishing attempt.

Technical security controls will support the efforts of your employees and protect the databases of the organization. Technical control is rooted in vulnerability management. System vulnerabilities will have to be identified and plugged. Patching, configuration changes, application updates are mandatory to remove code and software application vulnerabilities. The online system should be configured to automatically block malicious URLs and attachments. Spam filters and web filters will have to be used to ensure that only authorized and authenticated users are admitted into the system and cyber attacks are blocked at the gates automatically and effectively.

Do you need additional help in preventing Phishing? Let us show you how. Please contact us for a free, no obligation consultation.