One of the most common forms of attack you’re likely to encounter is phishing scams. The fact that thousands of people fall prey to them each year makes them a very lucrative attack strategy for cybercriminals. Fortunately, because phishing scams are so widespread, you can avoid them if you know how to spot and prevent them.
Learn How to Spot Phishing Scams
Although new phishing attack techniques are constantly being developed, they all have certain characteristics that can be seen if you know what to look for. There are numerous websites online that can keep you up to date on the most recent phishing attacks and their distinctive characteristics. For instance, messages with urgent call-to-actions, mismatched domains, or ones from first-time senders are all common signs of phishing emails.
Avoid clicking on that link
Even if you know the sender, it’s generally not a good idea to click on a link in an email or instant message. You should at the very least be hovering over the link to check that the destination is the right one. The destination URL of some phishing attacks can resemble an exact copy of the legitimate website and be designed to capture keystrokes or steal login and credit card information. You should bypass the link and go directly to the website if it’s possible to do so, through your search engine.
Employ Strong Passwords
An obvious take, there may not be a single recommendation as regards how to choose a strong password, but you should try alphanumeric ones and strong paraphrases on a secure Internet connection—say something that really protects.
Separate Company from Personal Accounts
Have you ever tried sending data from your company to your personal accounts, and vice versa? We suggest that you avoid doing such things as your professional account should be used for and remain in your company; on the other hand, our personal email accounts should be for personal documents and messages. Not separating your company email from your personal one may pose a risk not only to your privacy but also to the information, employee records, and even the reputation of your company.
Utilize Alternative Communication Channel
If your business has been using social media sites and emails for any verification of transactions, you may consider establishing a different channel of communication. To set up the process, you may opt to set up text or phone systems other than email.
Inform Changing Business Practices
It is good that your business may have been in constant transactions with your partner, thus forming a fixed set of communication lines. However, should you receive an email stating a sudden or suspicious change of practice from your partner, you should see the possibility of being targeted by cyber attackers. In such a scenario, choose to message your business partner on a different communication channel and confirm whether such a change comes from them. On the other hand, if you modify your business practice, always inform your partners.
Download Free Anti-Phishing Extensions
Most modern browsers allow you to download add-ons that identify the signs of a suspicious website or notify you of known phishing websites. As they are usually entirely free, it makes perfect sense to have them installed on all your organization’s devices.
Avoid Providing Your Information to Websites That are Not Secure
Don’t enter sensitive information or download files from a website if the URL doesn’t begin with “https” or if you can’t see a closed padlock icon next to the URL. It’s possible that phishing scams are not intended for websites without security certificates, but it’s better to be safe than sorry.
Change Your Passwords Frequently
If you have any important online accounts, such as a business email, you should make it a habit to change your passwords frequently in order to stop an attacker from gaining unrestricted access. By adding an extra layer of security through password rotation, you can stop ongoing attacks and keep potential attackers out of your accounts. This is important because your account may be compromised without you even noticing.
Install Firewalls
Firewalls serve as a barrier between your computer and an attacker, effectively preventing external attacks. When used in tandem, desktop and network firewalls can increase security and lessen the likelihood that a hacker will gain access to your environment.
Only Provide Personal Information when Absolutely Necessary
As a general rule, you shouldn’t willingly give out your card or personal information unless you completely trust the sender of the email. If you must provide your information, be sure to confirm the legitimacy of the website, the legitimacy of the company, and the security of the website.
Threats to Be Aware of
Out of convenience, we seem to let websites store our personal information, numbers, home addresses, and purchase histories. But with this ease of access on our favorite sites, we seem to be placing ourselves at grave risks – not to mention the high possibility that our money gets wiped off. Therefore, before we go for a click and let unauthorized access roam over our online visits or email creation, here are cyber threats we should not miss out on knowing:
- Malware: Whether you receive an email from a known organization or a close, dear friend, there is a good chance their emails contain cyber leeches. By cyber leeches, we mean Trojan, malware, and spyware, which may be embedded in any attachment we open. Downloading suspicious attachments online may get your system corrupted by these malicious web add-ons.
- Phishing: Hackers may send you emails which may appear to be coming from some legitimate source but are actually fraudulent. These emails install malware and steal your personal, precious data – probably your credit card information and the credentials you use when logging in.
- MitM: MitM stands for man-in-the-middle attack; you may relate this man in the middle to a broker. So when it comes to hacking, the perpetrator crosses over the path between your device and the server of the website you are visiting, i.e, to get your IP address. Thus, when you are using the internet, your interaction with the website may be secretly intercepted. This case happens because of unsecured networks and – again – malware.
- Password Cracking: As the term suggests, password cracking helps hackers gain access to your account – your email for example – for motives, such as monetary gains. To crack your passwords, attackers may use a software in their own system to compare various numerical, alphabetical, and alphanumeric combinations.
- APT: You must have been employed in your company for years and are still not aware that for years hackers have been constantly feeding on data moving around your network; then, you must be a victim of an advanced persistent threat or APT. Over a period of time, hackers have been benefiting from the unprotected information you and your co-workers share every day.
- DoS: If for some unknown reason, you suddenly cannot access your network, you may have been targeted with denial of service (DoS) attacks. What an DoS attack does is flood your network or machine too much information, leading to a network crash and eventually impossible access. With you or your company being deprived of access, the attack may result in theft or loss of data.
As mentioned, opening emails – unwanted or not – may peril your personal information, credit card details, and login credentials, as well as expose your company records, documents, and sensitive business information. Thus, picking up habits to efface business email compromise should be first on your list. With your email, your small acts can contribute a lot to your company’s cyber defense.
Here are some tips to follow.
- Click “Reply” Instead of “Reply All”: Rather than clicking Reply All, make the effort to click “Reply”. When an email carries several or many recipients through CC and BCC, remember that going for “Reply All” may put all of them at risk. Even if you are a trusted sender, you may not be aware that the email you are sending, sharing, or forwarding contains malware that corrupts systems. Plus, you do not want to get your friends and co-workers spammed. Therefore, if you are replying to the original sender, simply click “Reply”.
- Take Note of Deleted Messages: Your life would have been much easier if your deleted emails had been really deleted, completely gone. But take note that your trashed messages are saved somewhere on remote servers, which can be retrieved by any extremely adept hacker. Therefore, remember that what you send through email is like a permanent document. Be careful what you put into writing.
- Use BCC/CC/Forward Wisely: BCC, CC, and Forward work in a similar fashion, where everybody in the loop receives whatever is sent. While companies have standard operating procedures in reference to email correspondence, avoiding filling out the BCCs and CCs is a good idea. Forwarding such email may also forward unidentified malicious software to every recipient. For hackers, that would be hitting a lot of birds with one stone.
- Unsubscribe from Suspicious Accounts: This “Unsubscribe” link is useful. If you are unfamiliar with a link, do not open it. Or better, blacklist the email addresses. Our email servers are equipped with such functionality, so go ahead and get that email blacklisted. This way, you should stop receiving fake newsletters, giving you stronger security.
- Engage an Email Encryption Service: You or your business may get a function like email encryption service. Simply typing Encrypt: New Password in your subject line, for example, lets an email detect sensitive information such as a new password in this case. Then, when an email is encrypted, the recipients are instructed to download the message from a specified link, thus keeping information away from theft.
Getting Help from Cyber Security Professionals
Your privacy, your company’s, and your recipients’ means more than much to factors, such as reputation, protection from theft, and operational capability. Whether you are an individual, an employee, or a small or large corporation, it is high time you consult with a cyber security professional to keep yourself from cyber threats. However, before a talk with one, you should know what they can do to help you with cyber security.
- Ethical Hacker: Also called white hat hacker, an ethical hacker is simply a hacker that does ethical hacking. Estentially, an ethical hacker can help you attack the vulnerabilities of your system without tampering with credential details or gaining monetary advantage. Instead, an ethical hacker identifies such weak zones and protects them for you, thus securing your system.
- Security Architect: Quite similar to an ethical hacker, a security architect picks up a view of the overall system to spot and indicate cyber threats. Then, they focus on analyzing such threats and designing strategic ways to combat such attacks.
- Security Software Developer: These professionals are responsible for coding to develop software and/or applications to maintain cyber security. If you need an antivirus program or a tool that detects possible cyber threats, you may consider consulting with a security software developer.
- Chief Information Security Officer: The chief information security officer plays a crucial role in the overall protection of not only company assets but also technologies. Paired with their skills in technology, the CISO is responsible for the security of information, documents, and emails in general.
If cyber security is a challenge, you may consult with a cyber security professional and create #CyberSecureMindset.
