Phishing attacks are one of the most common security challenges that organizations and individuals face frequently in trying to keep their personal information and customer data safe and secure. Nobody wants to fall prey to a phishing attack, but unfortunately, no one is entirely immune from the possibility. Whether it is getting username and password combinations or credit card numbers and codes, hackers will use any method they can to steal valuable data. Email just so happens to be the primary attack vector for phishing attacks.
By ensuring you and your team have the necessary knowledge and tools to avoid becoming a victim to phishing, you can be your own best defense in the dangerous online world of cybercrime. For National Cybersecurity Awareness Month, we have created a 12-point checklist of things you can do to keep your organization, employees, and end users secure:
1. Ensure the right tools are in place
Installing an anti-phishing toolbar or implementing Mailbox Intelligence that detects and prevents these threats in real-time are some ways you can make sure your organization is protected. Deploying a spam filter that can detect suspicious senders and making sure all systems are current with the latest updates in security are key to avoiding phishing attacks.
2. Educate your employees
Ensuring your employees know what to expect and look for is not a one-time event. You must train, retrain, and remind on a frequent basis. This can be done in several ways: create a video, have an interactive session, implement mock phishing scenarios, or test your employees on how well they can catch a phish. Additionally, you can develop a security policy that includes password complexity and changes as well as encryption to block sensitive and confidential company information.
3. Avoid casual internet browsing
Careless internet browsing and clicking on random links without thinking can cause your organization to fall prey to phishing attacks. While you must trust your employees to make the best decisions, instituting a policy that prevents access to certain sites during work hours may be the way to go especially if your security measures have already been compromised.
4. Make employees aware of the psychology behind phishing
Ongoing user awareness and training is important but while you are training on the do’s and don’ts, be sure to make employees aware of the “why”. Some of the highest profile data breaches such as Sony for example, were started with phishing (or whaling) attacks. Make sure employees understand the psychological social engineering that happens as hackers play with user’s emotions and instigate a sense of urgency in their attack messages.
5. Implement multi-factor authentication where possible
Some accounts offer an added layer of security by requiring an additional credential to log in to your account on top of a username and password. This type of authentication often falls into two main categories: what you have such as SMS to your cellphone or what you are such as face ID. Having multi-factor authentication in place makes it much more difficult for hackers to get into your account.
6. Backup your organization’s data
Backing up your data frequently can guard against complete loss of information if an attack were to be successful. Most on-premises and cloud environments, allow you to do this type of backup of files, data and other necessary information. Be sure any backup system you use is not connected to your organization’s network.
7. Think twice before you click
It might seem like an obvious link, but hackers are keen on impersonating popular brands that users would see no harm in clicking to. Before you click on a link, check the sender’s email address and ensure it is from someone you know. You can often tell by taking a deep look at the actual email ID. If it is not from your organization’s domain or from a sender you know, skip the click.
8. Choose email providers carefully
Some email providers are much better than others at flagging potential phishing attack emails. Make sure your email provider offers two-factor authentication or includes high-level phishing and spam filters so you can receive alerts when phishing is being attempted.
Fight Phishing Effectively
Beating the bad guys always gives good vibes but it could pay off to have some professional help in fighting phishing attacks. GreatHorn’s solutions can help you to respond to phishing threats and attacks in-the-moment. Managed Cloud Email Security and Mailbox Intelligence can give you the peace of mind that you need to know that your organization is safe and secure.
