This past week we have witnessed four separate phishing attacks on small businesses. These attacks are pervasive and scary, but you can fight back. The trick is to be prepared.
A phishing attack is a cyber attack that uses your email as a weapon against you. The goal is to trick you into believing that the email is something you want or need such as a request from your bank or a note from someone in your company, so that you will click a link or download an attachment.
We have outlined for you what you can do to prepare yourself and your business against these types of phishing attacks.
One Recent Phishing Attack
One attack we witnessed this week came in this format. You can see it looks like any other email. The person this email is from is known to us (we have changed the name for this example), and it reads like a normal email. The email address is from a legitimate email. The link included in this email is a genuine one-drive address. So how did we know it was a phishing attack??
There are clues. 1. We haven't heard from this person in several years, 2. We have no knowledge of the project they are talking about.
Phishing attacks such as this one, tricks you into opening multiple links, then you are asked to confirm your identity by entering your email address and password. These credentials are not being entered into a legitimate authorisation source, instead you are actually entering them into the phishers' website disguised to look like the real thing.
Once they are in possession of your credentials, malware is installed onto your machine, giving them full access to your contact list. Then your own email system (Outlook etc) is then used to send on emails to all your contacts, looking for new victims of this scheme.
What's The Worst that Could Happen?
So what if the phisher has my email address and password. I will just change it, then they don't have it anymore.
Sure you can change your password. But by the time you realise you have been scammed, your email address and password has already been a valuable tool for the phisher. The whole interaction has told the phisher many things about you that are handy later:
Additionally, if you are a global admin on your network, they will have spent a little time setting themselves up a back door into your network, so they can send you something even more nasty, like a cryptolocker, which disables your network entirely.
What Can We Do to Prevent This?
There are two things you need to do, Prevention and Training.
Ideally, your email should be guarded from the internet as best as possible by implementing a SPAM and phishing protections.
Office 365 users have several options:
These tools will limit the number of phishing emails arriving in your inbox,
If you don't yet have Office 365, then there are tools for your network too. Drop us a line or give us a call for details.
No tool is perfect, so for those emails that do sneak into your inbox, your last line of defense are your users. Encourage your users to understand what a phishing email is, and what one will typically look like. Top ways to spot a phishng email is:
IF YOU ARE UNSURE IF AN EMAIL IS LEGITIMATE, DON'T CLICK IT, CALL THE SENDER AND CONFIRM. DO NOT EMAIL THE SENDER, IF THE EMAIL IS PHISHING, THE EMAIL ACCOUNT MAY BE COMPROMISED, SO ANY RESPONSE YOU GET MAY BE FROM THE HACKER.
Additonally, there are tools that you can use to test your users knowledge and understanding, so that they can improve such as:
If security is not on your radar right now, it should be.
Cyber attacks have increased 300% since COVID-19 has taken hold of us. We are vulnerable right now while we are worried about other things, so hackers are taking advantage. We are seeing this in real terms in our ticket list. Get some protection now. Don't wait.
Further reading from Microsoft:
Protect Yourself From Phishing
Protect Yourself From Phishing Schemes and Other Forms of Online Fraud