Phishing Attacks and How to Avoid Them

Phishing attacks are the bane of modern businesses, and any organization’s employees need to be cognizant of the threat they pose. Unfortunately, no matter how much you protect against them, hackers are usually crafty enough to work their way around even the most well-defended security measures. However, not even the best security measures can keep your employees from making a split-second decision to click on a link or download an infected attachment.

What Are Phishing Attempts?
Phishing scams are any attempt by hackers to steal credentials from your organization through crafty methods, such as posing as individuals within or without your business, targeted attempts on specific individuals (spear phishing), or impersonating a company’s CEO (also known as “whaling”). Whatever it’s called, the end result for a phishing attack is one that makes someone within your organization hand over credentials or other important information.

Vectors for Attack
The most important thing to remember about phishing attempts is that they can happen through a variety of ways. Social media applications, phone calls, and email are all the ways you might encounter a phishing attack. Here are some ways you can identify a phishing attack through a number of vectors:

• Email messages that spoof addresses and try to convince users that they are someone from an organization or company you’re associated with.
• Phone calls from people impersonating tech support or someone of authority, like the police or government agency.
• Social media messages on both personal and professional accounts are used by identity thieves to impersonate people you may know.

The Giveaways
Suspicious messages are the first throwaway sign of a phishing attack, but it’s not always so simple. Whether it’s a message from someone you haven’t heard from in a while, or one containing some strange words that don’t seem like the right ones used by the sender, you might be facing a phishing attack. Here are some of the other common ways you might identify a phishing attack.

• Spelling and grammar errors: There are often spelling and grammar errors in phishing messages, as well as embedded media that might be blocked due to being suspected threats. These threats might be warranted, so if you see blocked media or spelling and grammar errors, be sure to be extra cautious.
• A sense of urgency: If the message urges you to react immediately, there’s a good chance that the message is a phishing attempt. The only ones who benefit from you not thinking about something like this enough is a hacker, so be sure to take a message’s measure and ensure it’s legitimate.
• Suspicious account activity: Social media accounts can be faked pretty easily, so if a friend is reaching out to you and it seems out of character for them, always be cautious--especially if the request is asking for money or for you to click on a link bringing you out of your Gmail.

To limit the threat of phishing attempts, take the following actions now:

• Implement a spam blocking solution. While it might not help with more specialized phishing attempts, it should limit the most generic ones.
• Educate your employees--this point speaks for itself. If users know what to watch out for, they will be less likely to make mistakes that expose sensitive data.

PCSOFT can help you keep your users and network safe. To learn more, reach out to us at 02 98730080.