Menu
Menu
Menu
2020 was a difficult year for the entire world. Things have changed drastically from going out for work to working from your home. With this ‘New Normal’, most of us have become remote workers. As we all are depending on soft copies, emails, digital content, and the like there has been a shift to a greater dependency on technology at work and home. As a result of that cyber events have increased and specifically phishing attacks have dramatically gained popularity among cyber attackers. The motivations for these attacks range from profit to nation states to hacktivist.
The term ‘phishing’ comes from two English words: Fishing and Phreak respectively. It is a kind of spoof that cyber attackers use to gather the personal data of any person. Most of the time, Phishing takes place via email, voicemail and/ or messages. You can receive any deceptive email that comes from a known source, such as banks, or work.
As we discussed earlier, most phishing attacks occur via emails. Attackers choose to send emails using vendors you have worked with or are very familiar with in your daily work or home life. They manipulate human emotions or anxiety to get things done. Most common phishing emails use financial service names to prey on people. These emails have a link mentioned in the body, by clicking on it, the receiver will be redirected to a scam/fraudulent page. This is the best way to gather the personal information of the receiver.
As per one survey, in the first half of the year 2020, more than 70% phishing email was related to Covid-19. This was easy as people were scared and going through anxiety while dealing with this deadly disease. Any email related to Covid could make them click on the mentioned link. This way it was easy to trap them.
It is really difficult to distinguish between the two. Attackers not only use their names but also, their company logo, font style, banners, and everything that resembles the real company. However, there are a few things that you can consider while checking the emails.
1. Phishing emails do not use the actual business or company email IDs. The domain name is most of the time weirdly spelled or broken.
2. The messages in the email body always sound urgent. Such as ‘your account is pending’, ‘your account can shut down soon”, ‘How to treat Covid at home?” –are some examples of phishing emails.
3. You will be asked to provide your personal/confidential details.
4. They are generally grammatical mistakes in the body of the email
5. They always have an action to perform that starts with the URL link
While we understand the concept of Phishing, we must understand the importance of the prevention process as well. As you develop internal awareness within your company. Its important to develop awareness and develop a strategy to prevent and respond to phishing attacks.
1. Learn about phishing and how it can cause damage to your personal information as well as your business
2. Deploy secure email and phishing reporting option within your email server
3. For your company develop internal phishing training that is updated at least twice a year
4. Conduct phishing simulation and attacks internally
5. Develop a process of detecting anomalies within your enterprise endpoints and devices
6. Test your incident response plan annually
Attackers social engineers and phish someone by learning about them on social media accounts to make the attack effective.
As we have so many emails, social media, news, and other apps that we review and take action on daily, it’s very easy for the average person to miss and/or overlook a phishing email. In a rush to look through and multi-task we all make mistakes, and this behavior leads to many of us falling prey to cyber attackers. As we discussed, training is key to learning and continuing to improve skills on distinguishing phishing emails.
Hence, it is recommended to seek help from professional cybersecurity services to conduct phishing simulation and training. Improve your Incident response plan.
