There are millions of people using email daily in organizations across the United States. A preferred way of communication, emails can regularly contain sensitive data going in either direction. As many individuals receive a fair amount of email daily, it can be difficult to pay attention to small anomalies that might indicate something suspicious about the sender or the included content.
In order to remain safe from potential phishing attacks, we have put together a guide of three important tips to consider before replying to that next email.
What is phishing?
Phishing is a type of fraud that involves the attempt to obtain sensitive information such as credit card details, program usernames, passwords, and more through the disguise of a trustworthy entity via email.
There are many forms of phishing threats, including email and spear phishing. These serious threats have the attention of organization IT leaders as well. According to stats obtained by Security Magazine, 75% of company security decision makers ranked phishing attacks as the most significant security threat.
3 Ways to protect your organization from a phishing attack before it occurs
Though there are many steps involved in protecting an organization from phishing-related threats, employees ultimately hold the greatest responsibility. Acting as the first line of defense against these types of attacks, employees are encouraged to remain vigilant to incoming and outgoing emails. Vigilance is often the most critical step in stopping an attack before it occurs. What else can you and your organization do to remain safe?
-
Employee training
As mentioned, employees are usually the first to encounter a phishing scheme in their inboxes. The best defense, in this case, is education. Employers, specifically IT professionals, must take an active role in preparing a proper program to educate employees about different phishing scenarios and the best ways to react.
Pro Tip: The action plan should include an activity that has employees participate in mock phishing scenarios. For example, have them look at two emails (seemingly identical) and have them identify the small difference that may make one more dangerous than the other.
Employees should check incoming email addresses, grammar, and spelling to verify whether or not an email is legitimate. Sometimes phishing emails are well disguised with email addresses that are "off by a letter or two".
-
Implement a spam filter
IT professionals should strongly consider implementing a spam filter for incoming email. This would be a good way to stop suspicious emails from getting to employees in the first place. Spam filters can be very effective in detecting viruses, blank senders, and more.
Pro Tip: More specifically, consider installing anti-phishing software to your organization's systems. Anti-phishing software consists of computer programs that attempt to identify phishing content contained in websites, e-mail, and other forms before warning users and blocking them access.
-
Set-up multi-factor authentication on your corporate profiles
Even if a hacker has obtained credentials for corporate profiles, including social media or banking, it does not mean that they will automatically be granted access. If you have enabled multi-factor authentication (MFA), they will need to get past one additional layer of security which might prove to be most difficult. Most MFA systems send a verification code to the profile owner's email account or text messages. Only after entering this code will one be granted access to a profile.
Industry Example: Microsoft says that users who enable multi-factor authentication for their accounts will end up blocking 99.9% of automated attacks. This does not apply to Microsoft programs only; enabling MFA will have similar results for users of most other platforms as well.