We’ve all seen them: the emails with a “to” address that looks just a bit off. Or even a message from your manager or CEO that is written differently than you are used to. Although these are telltale signs of a scam, some phishing tactics are a bit more sophisticated.
In fact, phishing attempts like these—and plenty of other methods—have grown rapidly during the COVID-19 pandemic, making them one of the most common security challenges and one of the hardest to mitigate. Especially when the average company experiences 1,185 attacks every month.
However, email is not the only method anymore. These phishing attacks seek access to passwords, credit cards, or other sensitive information using social media, phone calls, texts, voicemails, and any other form of communication the scammers think of to steal valuable data.
So how can your business fight back against the growing digital onslaught? The team at Axians has put together a list of key steps you can take and what to look out for to help stop these phishing attacks in their tracks.
Build on your antivirus with an intrusion detection system.
Sometimes a phishing message can be paired with a malicious attachment. This means that even when a message is disregarded as fake, if an attachment is downloaded or opened, the malicious code could trigger and spread. Antivirus software can help identify and guard against known malware and vulnerabilities, and new virus signatures are added regularly.
But what about those more advanced forms of malware built within macros, embedded within code, hiding within your existing network traffic, or brought into your network by an unsuspecting employee? That is where an intrusion detection system (IDS) can add an extra layer of security to your network defenses.
An IDS works by identifying “normal” patterns and signatures of network and application behavior over time and flagging your team when something falls out of the ordinary. This heuristics-based approach adds an extra layer of protection to your network.
Expand your firewalls with advanced network tools.
Just like with antivirus software, firewalls on your internet-facing servers and devices can help to block known malicious traffic attempting to come into your network. These tools can be set to block known bad traffic based on regularly updated rules or set to only “whitelist” known sites, offering extra protection. When used together with antivirus software, firewalls ensure that even if hackers find a way to infiltrate your computer, their network traffic outbound can be limited.
Many organizations already have these tools in place, but your organization can add an extra layer of security with host-based firewalls that are configured on your more critical assets—both servers and end-user devices—to increase the amount of filtered traffic. Many organizations that deal with proprietary or sensitive data also use data loss prevention tools that scan emails and attachments to confirm if this type of data really is supposed to be distributed. If it isn’t, the application will block the traffic.
Educate your staff regularly.
Your staff members already have a lot on their plate, but taking the time to invest in and deliver regular phishing awareness training can go a long way toward helping your organization thwart these types of attacks. Your employees are the front lines, especially those in roles with access to sensitive information, such as finance, human resources, IT, executives, and operations.
Launch campaigns that encourage staff to “think before you click” and give them the tools to recognize the signs of a phishing attempt. Also make sure to give them resources about how to check the validity of certain messages and what to do when they suspect phishing.
If you want to take this education to the next level, consider utilizing a phishing simulation test, which tests what your employees have learned and gives you the data to identify groups that need extra training.
Implement multi-factor authentication.
In the unfortunate event that a phishing attack is at least initially successful, an extra layer of security defenses such as multi-factor authentication can help to put a stop to a malicious login attempt.
Multi-factor authentication can come in a variety of forms—either something you have (e.g., a token or mobile phone), something you are (e.g., biometric), or something you know (e.g., another passphrase)—and adds a secondary check that should flag abnormal activity. Even better, most multi-factor authentication solutions can utilize existing devices that users already have on them.
Install anti-phishing tools.
Google has identified more than 2 million phishing websites since the beginning of 2020. Give your staff another tool to fight back against this form of phishing with anti-phishing toolbars that can be installed directly into browsers. These tools automatically scan sites for known phishing scams and irregular security behavior or components (e.g., security certificates) and alert the user.
Take the next step.
Although there is no 100 percent foolproof method to avoid all phishing attacks, tools and techniques like the ones covered above can greatly reduce the risk and impact of an attack. Additionally, many of these tools cost less to implement and maintain than the cost of potentially having to clean up against a major cyber incident or data leak.
If you would like another great tool to fight back against cyberattackers, you can download our free resource The Ultimate Guide to Performing a Cybersecurity Risk Assessment, which will give you a comprehensive idea of your organization’s cyber-risk.
For more help on finding the right tools for your organization as well as how you can kick-start your own anti-phishing program, talk to an expert from Axians today.