Phrequently Asked Questions – Phishing PHAQ (FAQ)

Phrequently Asked Questions – Phishing PHAQ (FAQ)

What is Phishing?

‘Phishing’ is a method of fraud that involves tricking the victim into doing something could be volunteering information such as account names and passwords, wiring funds, or clicking links or opening attachments that have a payload of malicious software.

Usually, phishing happens via email, but increasingly phishing can happen via text, Facebook, Skype and virtually any online platform. Money or data is then illegally extracted or malicious software is installed.

How much harm can come from Phishing?

The potential for harm is massive, in fact, it’s virtually limitless. Just two recent examples give you some idea of the amount of harm that can be done through phishing:

  • Ransomware attacks such as WannaCry and NotPetya causing millions or in some cases billions of dollars of damage.
  • Data breaches such as the DNC email hack that influenced the 2016 US presidential election.

If you want more, here’s a list of the top ten phishing attacks JUST from the first half of 2017.

Phishing sounds really bad! How can I protect my organization from phishing?

The good news is there is a LOT you can to protect yourself and your organization and it’s not terribly expensive.

There are several things you can do. Doing any of these (if you’re not doing them already) will improve your chances of defending against phishing attacks. Doing ALL of them will make it highly unlikely that your organization will be severely impacted by phishing.

  • Security Awareness Training
  • Two-Factor Authentication (or 2FA)
  • Use Password Managers
  • Patch Management
  • Security add-ons (see below)
  • Reliable and tested Backups
  • Incident Response Planning
  • Properly configured SPF and DKIM records (ask your IT department or provider to help with this!)

What should I do if I receive an email I suspect is a phishing email?

Verify before clicking any links, replying or opening any attachments. Even if the email comes from a seemingly legitimate source, in fact, even if it comes from a colleague. You can VERIFY by contacting the sender (by means other than email) to ask if they did, indeed, send you this message.

Verify is the key action.

If the message does not pass verification, mark it as SPAM (or Junkmail). Simply deleting the email is also fine.

Uh Oh! I clicked a link and/or opened an attachment in what I think was a phishing email. What should I do now?

Report the incident to your IT support personnel immediately. Report it as an urgent, high priority ticket.

I’d like to get additional protection for my email, what can I do?

Review the list above about protecting your organization from phishing. If you would like to do even more, you can purchase add-on security services for modest fees typically ranging from $0.50-$10 per month per person depending on the service and the features chosen.

Additional Security Services for Email

Big Two (Gmail and Office365)
Office 365 Advanced Threat Protection
Gmail (Google includes all protection at no additional cost in all service levels - Yay for Google!)

A couple of well-regarded third-party tools

Barracuda Essentials for Email Security
The Email Laundry

What if I want to learn more about phishing?

This article (no, it’s not a phish, but seriously, THANKS for asking!) has some good information about past phishing attacks and impact plus some other ideas for protecting against phishing.