Greg Kelley

Greg Kelley is CTO for Vestige, Ltd, a company that performs computer forensic services and data breach response for organizations.

The one mistake companies make that leads them to fall victim to phishing attacks is...

First, their employees are not cautious enough to question whether they should open an attachment or click on a link to a site without verifying that the attachment is legitimate and the website is valid. Employees likely have a false sense of security that their anti-virus would catch any attachment if it is bad. Employees also do not look to see where the URL they are about to click on will send them, and when they get to the site, they do not review the address for validity or if their browser is reporting a properly authenticated SSL certificate.

Second, the bad guys are getting good at social engineering. They are doing their research on companies, reading blogs, news articles and other information to determine who works at a company, what their email address is, what their position is and with whom they might be communicating. The result is a well-crafted spear-phishing email catered to the recipient.

These attacks cannot be prevented but they can be mitigated. Companies should train their employees in regard to email use and detecting phishing attacks. This training should be done at onboarding for new employees and everyone should get a periodic refresher course. Companies should also review what information of theirs they make public and carefully consider what information should be made public and what should not.

David Ting

@imprivata

David Ting is the CTO at Imprivata.

The one mistake companies make that leads them to fall victim to phishing attacks is...

Most organizations have reinforced their perimeter defenses, but attackers have turned to exploiting the inherent vulnerability of employees. Spear phishing attacks, for example, use cleverly disguised requests for login credentials (i.e., to install a security patch or upgrade their Microsoft Office software) to dupe unsuspecting employees into entering their usernames and passwords. Spear phishing and similar attacks hinge on users being responsible for discerning the difference between a legitimate screen and malware requesting login information. Even for well-informed users, this task is increasingly more difficult as attackers get more sophisticated. When employees are left with the responsibility of determining the legitimacy of a request, the results can be disastrous - it only takes one or two users to compromise the entire system.

To address this, organizations can leverage a multi-layered approach to security. Single sign-on (SSO) and strong authentication, for example, eliminate the need for employees to ever manually enter passwords to access systems, applications or information. If an organization has SSO and an employee is asked for credentials, there is a strong likelihood it is a phishing attack. What's more, these systems can be configured such that your employees would not even by able to manually enter passwords, even if they wanted to, because their password strings would be unknown to them.

Tom Clare

@AWNetworks

Tom Clare leads corporate and product marketing at Arctic Wolf and brings over 20 years of security marketing management to the team. Prior to joining Arctic Wolf, he led product marketing at Websense for their TRITON security solutions and Blue Coat for their Secure Web Gateways.

The one mistake companies make that leads them to fall victim to phishing attacks is...

People will open and click on email links, even more so when they are expecting an email for a delivery, an IT alert or a seasonal tax status notification. Phishing and spear phishing rank high in security analysis reports because the tactic works. The age old premise of a secure perimeter with preventive defenses has passed. A balance between preventative and detective defenses is required. Simply put, the preventative guards detect known bad and then the detectives need to find the unknown, such as hidden infections, open exploitable vulnerabilities, misconfigurations and security risks.

Start with the assumption that phishing email links will be clicked, providing cyber attackers the opportunity to move past your preventative defenses. The question is then - are you running continuous monitoring detective defenses? A solid baseline of monitoring will provide a normal range to then determine abnormal activity. Statistical and behavioral baselines are one form of machine analysis, plus pattern recognition, signatures and white listing. More advanced analysis uses data correlation models often provided within Security Information and Event Management (SIEM) solutions.

Detective defenses are also finding value in visualizations, providing the human eye the opportunity to pick out anomalies much faster than machine analysis. In narrow cases like fraud, machine analysis is effective, however for advanced persistent threats (APTs) often introduced through phishing emails, wider visibility and depth is required. Security analysts need the ability to search, pivot and trace with an analytical mindset.

Given people will click on phishing email links, you have to collect and look at the data to see infections and nefarious activity in your network. Ask yourself a simple question, what is the ratio of your preventative to detective defenses? This simple ratio is likely to answer the question about preventing and detecting phishing attacks.

Luke Zheng

@luke_zheng

Luke is the engineering lead at Stanza and a former engineer at Microsoft and Tesla. He's a graduate of Carnegie Mellon CS.

In my opinion, the one mistake companies make leading to phishing attacks is...

Mid to large companies often re-forward emails that are originally sent to one or two people. However, the recipients can be many, which increases the chances of multiple individuals clicking on a single email. Given the event of a phishing email, the chances of open rates/outbound clicks greatly increase in a model like such. A good way to prevent this scenario is to not only have phishing filters for any emails inbounding, but also prevent re-forwarding of emails to multiple people or distribution lists.

Smaller companies (startups) often have their founders as main points of contact via email. They also often use the same founder emails as logins for a wide range of websites. The chances of phishing increase with more inbound emails. Once a particular email gets sent using the identity of a founder, the legitimacy increases once forwarded to others in the company. This will result in more chances of outbound clicks even on a smaller group of individuals. A good way to prevent this is to not associate one email as the login for many websites, and not have founders be associated with such addresses.

Derek Dwilson

Derek Dwilson is a security expert and attorney. Derek has been passionate about technology and security his entire life. He has a law degree from the University of Texas and he has led the security, IT and legal ventures of Texzon Utilities. He currently consults with businesses on security solutions.

In order to prevent phishing attacks from succeeding, companies must remember...

Phishing is a problem on two fronts. First, a hacker may gain valuable access to a single account through a successful phishing attempt. Second, if an employee is using the same password for multiple company accounts, then the hacker has now gained access to a great deal of confidential company data.

On the first front, there are several warnings signs to look for. Often, Gmail will give you a warning near the subject line if the email sender looks phishy. A second line of defense is your browser. If you're visiting, for example, a fake PayPal site, then you may see a popup or icon indicating that something is suspicious. Employees should be trained to look for these warning signs. But they should also be trained to never give out sensitive information over the phone or by just clicking on a link in an email. Instead, if a credit card company calls, call them back using the number on the back of your credit card. If you get an email from PayPal, don't click on the link. Instead, go to PayPal directly.

On the second front, one can secure the company by using SSO tools such as LastPass and Yubikey. LastPass Enterprise allows employees to only have to worry about remembering one password, while creating a unique password for each log in. If you only use one password per account, then a hacker’s password bank will only be useful for that one hacked account. And because companies are often aware of break-ins and notify the public, LastPass can easily let you know which account passwords need to be changed.

But in addition to making sure each employee uses his or her LastPass password ONLY for LastPass, there is another layer of protection that you should set in place: YubiKey. YubiKey acts as a second factor in “two-factor authentication.” This ensures that no one can hack into your LastPass account. If all your passwords are created through LastPass and YubiKey adds a layer of protection to LastPass, then your accounts will be very difficult to break into.

Amit Ashbel

@Checkmarx

Amit Ashbel is a Product Marketing Manager at Checkmarx in Israel.

In my opinion, the one mistake companies make leading to phishing attacks is...

Phishing attacks are not what they used to be. Back in the old days, spammers and scammers used to send mass email campaigns leading people to a false web-site. The techniques have adapted since. Nowadays targeted attack tactics are more popular.

It works like this:

1. Mark your goal - What do you want to gain? Money, Information, PII, CC numbers.
2. Choose your target - Locate the correct VP, Director or C-Levels. Selecting your target depends on what you want to achieve.
3. Perform a Background check - Plays golf, Married, 2 kids, Favorite car, anniversary coming up soon and liked Flower.com on FB.
4. Launch your attack - Send a congratulation email from flowers.com including a link for a free anniversary gift.

The idea is to gain the victim's trust by using information they feel secure with. Take that and add a free gift with a malicious link and you have yourself a successful spear phishing attack. The link could download a piece of malware for financial or espionage purposes, or could trick the victim into giving out their CC number or other sensitive information.

Spear phishing attacks require more preparation however have a better success rate.

How to protect the organization:

1. Employ clear guidelines - If you know the sender, be hesitant. If you don't know the sender, either check with your IT department or delete the email.
2. Educate employees to use the web securely.
3. Invest in security controls for cases where your employees make a mistake... they will.
4. Analyze your internal development processes to make sure your internal applications are not easily exploitable whether containing employee data or financial statements.

Ashley Schwartau

@SecAwareCo

Ashley Schwartau has been with the Security Awareness Company for over a decade, with experience in every part of the creative process, from conceptualizing and design to implementation and delivery. She works on every single client project that comes in the door, helping companies make awareness training effective, whether it’s short awareness videos and custom e-learning modules or a large global-scale awareness campaign. Her specialties include video editing, graphic design and creative problem solving. When she’s not making up new ways to present old ideas, she writes fiction, watches a lot of Netflix and walks her cats in the yard.

In my opinion, the most important step companies should take to protect against phishing attacks is...

EDUCATE your users.

Remind them about it on a regular basis. It's not a one-and-done situation. We all need reminders on a regular basis to drink our water, eat our vegetables, stand up when we've been sitting too long, to recycle… we also need reminders about changing our passwords and what to look for in phishing emails. Especially since phishing emails are getting more sophisticated.

TEST your users.

You can do this in a number of ways. Quizzes (after training), games, or periodic phishing campaigns against them. Companies like PhishMe and PhishLine offer these kinds of services that allow you to create phishing campaigns that tell you how many people clicked on the links so you can offer them more remediation and training.

Companies fall for phishing attacks due to not training their employees and assuming that people know more than they do. A lot of people leave their common sense at home or just have too much on their minds when working and click too fast. They see something and click instead of thinking hey that doesn't look quite right... People need to slow down and think before clicking, and companies need to educate their users about the risks of phishing emails. If the employees don't understand the risks associated with clicking on phishing links, why are they going to stop? If you educate them about the risks (to both the company and to the employee on a personal level), and teach them what to look for in phishing emails, then the number of clicks will go down.

Peter Moeller

@S_H_Law

Peter Moeller is the Director of Marketing for Scarinci Hollenbeck, LLC a 5 office, 55 business attorney law firm that has an extensive Cyber Security & Data Protection practice in NY/NJ/DC. He is the key driver of firm marketing initiatives including the implementation of a full scale web 2.0 lead generation platform. He leads a marketing team, vendors, and technology to drive business growth and increase brand awareness.

In my opinion, the one mistake companies make leading to phishing attacks is...

Phishing attacks are very sophisticated and tactful and come in many different forms of communication. Most phishing attacks will come in the form of an email, although they can also come by websites, physical mail or by phone calls. Companies tend to fall victim to attacks if they: 1. Do not educate their employees and 2. Don't have a system in place that can flag communication that might be malicious.

Preventing phishing attacks can be easy but it takes education and having plans in place to protect your company if something does slip up. First and foremost, it is vitally important to educate ALL of your staff on best internet/email practices. Educating your staff will allow them to question communications that don't seem right and will also allow them to follow best practices in order to investigate the communication they received. Have someone knowledgeable about phishing activities in place to help employees screen questionable communications. Make sure you teach all employees to never click on links, or open emails with specific file types, such as .exe files. Always open separate web tabs and research the email, sender, or links that are coming in. More often than not, you will receive immediate search results that flag the information as Spam and or being malicious. Educating your staff once is not enough. Constant reminders and updates should be conducted. When a phishing attempt is caught, share it with your staff, so they can familiarize themselves with how they look and feel. Having your staff on board and on the lookout for these type of scams will increase your chances at protecting your firm overall.

Nick Santora

@Curricula

Nick Santora is the chief executive officer at Curricula, a cybersecurity training and awareness company headquartered in Atlanta, GA. Prior to Curricula, Nick worked as a cybersecurity expert at the North American Electric Reliability Corporation (NERC), an agency that ensures the security and reliability of the bulk electric system in North America.

In my opinion, the one thing companies must do to stay protected against phishing attacks is...

Continuous cybersecurity training and awareness. We are reinforced on a daily basis to not talk to strangers, be careful with what we eat, save our money for retirement, say please and thank you, etc. How often are we reinforcing current cybersecurity threats and educating our staff on a routine basis? Until organizations take initiative to educate their people, we will continue to see alarmingly high engagement with phishing emails.

Anne P. Mitchell

@annepmitchell

Anne P. Mitchell is an Internet law and policy attorney, an Internet security expert, and heads the Institute for Social Internet Public Policy (ISIPP).

Here is something that is rarely talked about, and yet is a way that companies fall victim to phishing attacks on a regular basis...

Nearly every email program uses the 'from' section of an inbound email to display the contact's 'friendly name' (i.e., Anne Mitchell, rather than [email protected]) and photo. All it takes is the phisher spoofing a known email address, and the recipient automatically trusts it, never imagining it could be from anyone else, let alone a scammer. In fact, this is exactly how Medidata was phished out of more than $4 million. (We wrote this up here.) So, to prevent this sort of phishing or at least to not make it so easy for the scammers, we recommend that companies disable the display of friendly names and contact images in their email clients.

Tom Kemp

@Centrify

Tom Kemp is the co-founder and CEO of Centrify, a leading provider of cloud-ready Zero Trust Privilege to secure modern enterprises.

I personally have seen an uptick in CEO fraud attempts, whereby crooks use social engineering and spear phishing to get executives to wire funds to crooks...

Going back to 2015 and continuing today, someone at Centrify receives an email from Tom Kemp, the CEO asking to help initiate a wire transfer on a monthly basis. That cadence has increased to a weekly or twice-weekly experience.

The scammers are also being more targeted now in terms of who they contact. Historically, they have done simple LinkedIn or Google searches and then gone after the HR manager, payroll clerk or finance director. But now, they know a bit more about our organization. This may have to do with recent breaches of B2B companies that aggregate a lot of information about employees at companies.

What to do?

1. Educate employees on CEO fraud.
2. Always pick up the phone and call to confirm an out-of-band request, even if you think the CEO may be mad.
3. Implement multi-factor authentication on critical business applications.

A newer technology that anti-spam and email security vendors offer is the ability for security solutions to issue a warning when they see an impersonating email coming in.

For example, the email security system that Centrify uses internally produces the message, Warning: The Display Name used in this email matches an internal employee's name, in the subject line. It's very helpful to flag these types of email and I would highly recommend turning on this switch.

Jacob Ackerman

@SkylinkDC

Jacob Ackerman is the Chief Technology Officer at SkyLink Data Centers in Naples, Florida.

The biggest cybersecurity threat for businesses evolves from their people...

People are the biggest security risk. People are the target. I recommend that companies test their staff with fake phishing emails. Exercises like this will create a level of awareness and preparedness amongst the team.

People are the easiest way to gain access, especially given all the great technology tools like firewalls, etc. For example, something as simple as a sticky note posted on a computer monitor with a written down username and password reminder might be all a hacker needs to penetrate your network. A hacker could subtly angle their camera phone to grab a pic of it in the middle of a casual conversation with the associate at their desk.

Your IT people can't protect you from maintenance uniforms! If you have third party office cleaning, air conditioning, and other vendors walking through the office (especially after hours), any password information left available on desks is a risk.

Stop your staff from writing down passwords and storing in a drawer or under their keyboard. Also, business owners or technology leaders that are in a first floor building should regularly walk around the perimeter outdoors and inspect what can be seen through windows. You may be surprised what kinds of information staff have visible at their work space.

Business owners shouldn't only be concerned about security threats from fancy computer scripts, phishing emails, ransomware, malware, etc. but the lack of password policy inspection and enforcement happening right in front of them daily. These are all low cost prevention tactics that have high impact on protecting a business.

Aidan Simister

@LepideSW

@aidansimister

Having worked in the IT industry for a little over 22 years in various capacities, Aidan is a veteran in the field. Specifically, Aidan knows how to build global teams for security and compliance vendors, often from a standing start. After joining Lepide in 2015, Aidan has helped contribute to the accelerated growth in the US and European markets.

Lack of employee education is the main reason that employees click on phishing links...

Phishing emails are becoming more and more complex and targeted. With the mass of data beaches that have happened within the past year, cyber criminals are able to tailor an attack to that individual.

The first place to start is to train all employees, managers, and third parties to spot phishing emails, and make sure they are fully aware of their security responsibilities. If your employees know how to spot a potential phishing attack, they will be far less likely to fall for it. One of the best ways to ensure that your staff are vigilant in spotting potential phishing emails is to carry out a simulation. Send out an illegitimate email to all staff members asking them to click on a link, and then monitor who and how many people go through with it.

Whenever possible, use multi-factor authentication, which can prevent the attacker gaining access to your system even if they manage to gain access to a user's login credentials. Grant employees with the least privileges necessary for them to do their job. This will at least minimize the attack surface, should the attacker manage to obtain an employee's login credentials. F or example, if one of your junior employees falls victim to a phishing attack, the impact will be fairly minimal as their access levels should be limited. If, however, a senior administrator falls victim to the same attack, the malware could leverage domain account privileges to affect servers, endpoints, and sensitive data from across the entire network.

Mike Baker

@Mosaic451

Mike Baker is Founder and Managing Partner at Mosaic451, a managed cyber security service provider (MSSP) with expertise in building, operating, and defending some of the most highly-secure networks in North America. Baker has decades of security monitoring and operations experience within the US government, utilities, and critical infrastructure.

Phishers often perform research before launching their attack...

Hackers examine the target company’s website and social media networks and learn about the company’s employees, their positions and responsibilities within the company, even their personal interests and hobbies – anything that they could use to make the phishing email look more genuine.

Phishing has become a great sport for cyber criminals because they offer a simple but highly effective cyber attack vector that takes advantage of the most vulnerable of prey – humans! One of the human vulnerabilities phishers exploit is employee desire to please bosses or authority figures. Employees should be encouraged to ask questions about any requests that seem “off,” even if the request appears to have come from a top executive.

Because phishers scour company websites and social media networks for personal information on executives and employees – and information about the company’s activities, such as new clients and new markets – businesses (or anyone) should be cautious about what they post publicly on the web. Likewise, organizations should educate their employees on the dangers of posting too much information on their personal sites. A hacker looking to launch a phishing attack may examine employees’ personal social media feeds as well.

What steps could organizations take to protect themselves from phishing scams?

Organizations cannot depend on email spam filters to prevent phishing. While spam filters intercept most regular phishing emails, imposter emails often bypass them because only a few emails are sent at a time, and they do not contain wording that spam filters pick up on (like “porn”). Hackers take time to make them look like legitimate business correspondence.

Know the telltale signs of phishing emails. Although phishers go to great lengths to make their emails look legitimate, many attacks originate overseas, with the emails composed by hackers who are not fluent in English. As a result, the email may use British spelling, contain punctuation, spelling, or grammar errors, or be worded oddly. The salutation or the closing may also be off. Also carefully examine reply-to addresses and look out for spoofed domains that are only slightly different from the company’s actual domain.

Establish protocols for wire transfers, payments, and the release of sensitive information. Implement a payment system that requires a purchase order that is approved by both a manager and a finance officer; a multi-person approval process for transactions exceeding a certain dollar amount; and phone verification of all fund transfer requests and any changes to vendor payment information. Likewise, the release of employee W-2 data and other sensitive information should be subject to the approval of multiple parties and a verification process that ensures the party requesting it has the legal right and a legitimate reason to access it. Further, company policy should prohibit highly sensitive information – whether bank account numbers or employee Social Security Numbers – from being transmitted via email.

Conduct regular penetration testing. Organizations should have their internal security staff – or enlist the services of a managed security services provider (MSSP) – conduct regular penetration tests aimed specifically at social engineering techniques such as phishing. These tests involve “good guys” sending “phishing” emails to employees and executives to see if they click on them or report them. The results can be used for employee education and, if necessary, for restricting the system access of certain users.

Encourage healthy skepticism. Establishing strict and specific authentication protocols helps with this; if employees know what the company’s protocol is, they are better able to recognize requests that do not appear to follow it. But, that will never work 100%, so organizations need endpoint protection in concert with content monitoring/filtering.

Jackie Rednour Bruckman

@myworkdrive

Jackie Rednour Bruckman is the Chief Marketing Officer for MyWorkDrive.

Companies and organizations easily fall victim to phishing attacks often during...

Rushed times of checking company email on their phones and devices and not properly vetting an email with a directive to click a link. Before they know it, they have unknowingly reset a password or given some information that allows a bad actor to penetrate and compromise their company network. This scenario made headlines during the Presidential campaign of 2016 when Clinton Campaign Manager, John Podesta got a phishing email looking like a Gmail request to change his password for security reasons. In minutes, thousands of emails were in the hands of hackers.

This scenario could have been avoided by a simple password security protocol aggressively messaged and adhered to by staff. In particular, any request for password updates, security email links, etc. should be forwarded on to IT and Security staffers for vetting, and the user then deletes the email out of the inbox entirely.

Better yet – a solution would involve not using any public cloud platform at all for high risk emails, high profile accounts, and high level secure communications. Using an Exchange server set up behind firewalls would have helped during this scenario. A strict computer usage policy must be created, messaged, and adhered to for any organization large or small in this digital age. This includes some simple rules like no clicking on links or attachments from anyone not known and unfamiliar.

Aggressive malware protection must be on the networks and kept current and working as well. Data leak and data loss prevention must be part of any enterprise structure and strict protocol must be followed for any remote logins and remote desktop situations as mobile device management becomes part of enterprise network security.

Idan Udi Edry

@iuedry

Idan Udi Edry is the CEO of Trustifi, a software-as-a-service company offering a patented postmarked email system that encrypts and tracks emails. Before his work with email encryption, Idan served as an Israeli Air Force officer for more than eight years, reaching the rank of captain and leading hundreds of professionally trained military personnel in building and operating advanced information systems. A trusted authority in information technology and data security, Idan has 13 formal certifications from the most renowned IT and telecommunications organizations.

Cybercriminals are getting smarter with their attacks, and with a major increase in email breaches and data compromises this year...

There are more security measures to make sure are always implemented. Year after year the number of cyber scams increase due to malware and spear-phishing campaigns. To prevent this type of attack from compromising your information, it is EXTREMELY important to pay attention to where emails are coming from. Many cyber scammers spoof large company mass emails with similar subject lines or body content hoping you won't notice. Always look at the email address; this will let you know immediately if the email is coming from a reliable source or not. If you aren't sure, don't negligently download or click on malicious files in an email resulting in ransomware or other malware being downloaded onto the computer.

People are often unaware of another phishing method cyber attackers implement to access your information, and that is through Wi-Phishing. Hackers often use Wi-Phishing to try to trick you into logging on the wrong network to get ahold of your information. Always ensure your network is private with servers protected by firewalls and anti-virus/malware software. When using public Wi-Fi, always check that you pick the most legitimate network. It's also best to pick a secure network hotspot that requires some sort of password to allow usage access. Most laptops and cellular devices have their own hotspot abilities. If you ever are questioning your safety you can try this option. It won't be very fast, but it will be more secure.

Chris Gonzales

@MyIT1

Chris Gonzales is one of the premier network strategists in the Southeast United States with numerous certifications and decades of consulting with highly regulated industries including banking, healthcare, and manufacturing. He joined My IT in 2012 as the company's operations manager and rose through the ranks to Chief Technology Officer and, now, Chief Operating Officer. In 2016, Chris was named one of New Orleans CityBusiness' Ones to Watch in Technology.

Companies, large and small, fall victim for phishing attacks because they rely on one or two mechanisms, such as a firewall and spam filter, and think that they are bulletproof...

No layer of cybersecurity is immune to penetration, especially with zero-day attacks (first time a virus is seen). We layer multiple layers of security including firewalls, email and web filtering, security-operations-center, threat sweeping, and user training.

User training has been one of the most effective ways to eliminate threats because attacks can slip by hardware and software. Many phishing attacks contain no links or attachments, so they do not raise any flags with spam filters and other protection methods.

Additionally, phishing attacks work because companies have poor approval processes in place. Accounting should never send money anywhere and HR shouldn't send confidential data per an email request from the CEO or CFO without verifying by another means such as a text, phone call, or just walking down the hall and talking to the person.

Michael Brengs

@Optimal_IdM

Michael Brengs is a recognized identity management expert and industry speaker who has been deploying identity management solutions for 20+ years and is currently a Managing Partner with Optimal IdM. Mr. Brengs attended the University of South Florida where he earned a degree in Management Information Systems and is a Microsoft Certified Professional.

First, phishing emails are crafted to look legitimate, such as saying Bank of America Customer Service for the display name of the from in the email...

But if you look at the detail of what the real email account is, it may be something entirely different. Some common red flags to identify a phishing e-mail:

• Be sure to look at any hyperlinks by hovering over them before you click. The text of the hyperlink might look legit but the actual redirect URL could be something bogus.
• Look for misspellings or poor grammar. Many scammers are not native English speakers and make grammatical mistakes.
• Never give up any personal information from an unsolicited email. If your gut says this is fishy, it probably is phishy.
• Do NOT click on any attachments from unknown sources. If this is your corporate email, notify your IT staff.

If you receive a phishing e-mail, delete it, do not click on any hyperlinks. Do not respond to the email. Empty your trash folder. Alert your corporate IT department that you were being phished. If you fall for a phishing scam, reset the password for that site you thought you were logging into. Do NOT use a password similar to another site's password. Monitor that account closely for at least 90 days on a daily basis. If it was banking or another sensitive nature, contact their IT department and let them know the situation.

Marc Enzor

@geeks_2_you

Marc Enzor is the President of Geeks 2 You, an IT consulting Firm. Marc has spent the last 22+ years working on cybersecurity for small to medium size businesses.

Phishing attacks have become a daily threat for every organization, and they aren't slowing down anytime soon...

The problem is, they work exceptionally well. Attackers have even started Spear Phishing attacks; these are attacks that are highly targeted. I've seen fake emails looking like they came from the CEO of an organization sent directly to Accounts Payable departments, asking for wire transfers to random bank accounts, telling them to only let me know when it is completed and that they are under a deadline. When the CEO demands you do something, you are used to doing it immediately and not questioning. So how do we solve these serious threats?

The primary answer is that IT departments need to simulate attacks and train the victims. There is a plethora of phishing testing services that will allow IT/Cybersecurity teams to craft fake phishing attacks and send it out to all the employees of the organization. It'll then report on who fell for the attack and clicked the link or provided their password. IT can then subject those victims to special training so they know what to look for, and how to avoid being a victim in the future. This is the only comprehensive solution that can be proven to work.

Other efforts can and should be made to upgrade email firewalls and add in specialty filtering for common phishing attacks. When it comes to specialized spear phishing emails, they will always be difficult to stop. The more research the attacker puts in, the more likely their attack is to succeed. The attackers are quickly learning this, and will only become better at evading spam/phishing filters, and reaching their targets. Other efforts should be made to train staff to always double- or triple- verify all bank transfers. Lastly, email accounts should have mandatory password expirations set to 90 days, so employees are forced to change their passwords often. This will automatically patch up any passwords that may have been taken during a phishing attack, and will eventually block out attackers.

Aaron Birnbaum

@SeronSecurity

Aaron S. Birnbaum is the Chief Security Officer at Seron Security. Mr. Birnbaum has nearly 30 years of consumer and business sales, partnership, and marketing experience. He has worked with companies of all sizes – from Fortune 500 to startups and has extensive experience with a number of different industries. Mr. Birnbaum has the unique ability to initiate ‘win-win’ discussions, explain clearly and concisely how technology works in a granular ‘easy to understand’ level, and to work successfully with many diverse types of people. As Founder and Principal of CITM, Mr. Birnbaum helped a variety of small to midsize companies by developing business plans, marketing strategies, sales programs, and recommending new technologies. He has worked across a broad spectrum of industries and has personal relationships with many Fortune 500 companies including AOL/Time Warner, Amtrak, MCI/WorldCom/Verizon, Burger King, Citicorp, Coors Brewing Company, Hill & Knowlton, P&G, Coca-Cola, Bank of America, Weiden+Kennedy, Puma, and Nike.

There are several different reasons that businesses become victims of phishing attacks...

Three of the most popular being: inadequate security training, a lack of security policies, and a lack of proper social media usage. By providing regular security awareness training to employees, a business can drastically reduce their risk and exposure to these attacks.

Phishing is a method of gaining access to a network, a person or a company's private information with the implied intent to do harm. There is 'spear phishing' - targeting a specific individual, usually after gathering data on social media websites, 'clone phishing' – where a user is fooled by a legitimate-looking email that contains an attachment or bad link, 'CEO fraud' or 'whaling' – where the target is a senior person in the company and requests an employee provide verbal or in writing private confidential information, or is persuaded to send money or information to an impersonator or an external source. General phishing is an attack where a user is directed to download an attachment or visit a copy of a reputable site but that is hosted on a different domain. There are also techniques called 'vishing' and 'smishing' that utilize the same techniques on voicemail and SMS or text messaging.

The most popular goal of this can be achieved by persuading a user to download malicious software (malware) compromising the network the user is operating on. This can be done by disguising an email attachment with a common name (e.g. 'spreadsheet.xlw', or 'file.pdf'), or by directing a user to click a link to visit what they think is a safe site. A common example would be a notice from your bank that your account has been compromised and you need to click a link to reset your password. When you click the link in the email, you are directed to a website that looks very much like the real site, but is hosted at a different location. An example of this might be a request to update your password at 1inkedIn.com or Linked1n.com instead of the real website LinkedIn.com. Users that aren't paying close attention can easily fall victim to these tricks.

The best way to combat these threats is to educate the users that are targeted. Security awareness training programs can help teach users good habits, and should be followed up with sending fake emails to test the users. Users that fail should be retrained, disciplined or potentially terminated. Other methods include: Never click on a link in an email, open the browser and type the URL in manually. If you get a request from someone that seems 'strange' pick up the phone and verify the request. Have a security policy for employees with specific examples of how to deal with possible situations. Look for typos, poor grammar, misspellings or bad links to images in emails and websites.

Frequently Asked Questions

Take Your Next Step
Towards Preventing Phishing Attacks