Email Phishing attacks are on the rise and we have seen a significant number of cases being reported and user falling victim to this
To prevent you from becoming a statistic of email phishing attacks, we have put together some information that will help you stay safe and secure.
What is email phishing?
Phishing that targets individuals is an attempt to fool the recipient of an email that it has been sent from a known or trusted sender.
Phishing
Phishing is the attempt to acquire sensitive information such as usernames, passwords and credit card details (and sometimes, indirectly, money), often for malicious reasons, by masquerading as a trustworthy entity in an electronic communication.
Techniques
Phishing combines a number of techniques to successfully steal your information.
Social Engineering
By researching a company (departments, key staff & executives) the attacker can target specific individuals and roles such as the finance department.
Email Spoofing
By forging the headers of emails the attacker attempts to fool the recipient into believing that the email was actually sent by a known and trusted source (e.g. the Finance Director or MD).
Counter Measures
Vigilance, Training & Process
People in positions of authority within organisations need to be vigilant and aware of threats and attacks.
Here are a few things we suggest you consider:
Internal communications ensuring staff, especially those most exposed to the risk (e.g. executives, management and finance staff) are made aware of the threat and risks.
Specialist training organisations offer courses to help educate staff about the threats and risks faced.
Internal company policies and workflows should also protect the company from losses due to an individual member of staff being compromised (e.g. dual sign-off).
2-Step Verification
Learn more about how 2-Step Verification can add an extra layer of security for your users. The verification code can be generated by a number of methods, including SMS TXT and Authenticator App.
Email Authentication
The email industry and standards bodies continually innovate in an attempt to secure against new threats.
The practice of Email Authentication has evolved to develop specific counter measures in reaction to the threat of Email Spoofing.
Businesses can utilise best practices and methods to protect themselves from attacks such as spearphishing by adopting Email Authentication comprising:
SPF – Sender Policy Framework - An open standard specifying a technical method to prevent sender address forgery
DKIM – DomainKeys Identified Mail - DKIM provides a method for validating a domain name identity that is associated with a message through cryptographic authentication
DMARC – Domain-based Message Authentication, Reporting & Conformance - Builds on the widely deployed SPF and DKIM protocols, adding a reporting function that allows senders and receivers to improve and monitor protection of the domain from fraudulent email
To adopt Email Authentication methods requires changes to be made to the DNS (Domain Name Service) records for the domain(s) to be protected.
Adoption requires careful planning and execution as mistakes or omissions can lead to the disruption of email flow.
Speak to your IT department or service provider and ensure that you have these measures in place to protect your organisation from email phishing attacks
Gmail Advanced Security
Enable Gmail's Advanced Email Security features from the Google Admin Console.
Password Alert Chrome Extension
The Password Alert Chrome Extension (provided by Google)
It warns and stops users if they visit a fake Google Sign-in web page.
Such pages are created by criminals to trick Google users into entering their login credentials (username/password) into a faked page where they are harvested and then can be used to gain unauthorised access to the user’s Google account.
See the G Suite Tip: Password Alert Chrome Extension
Speak to your IT department or service provider and ensure that you have these measures in place to protect your organisation from email phishing attacks