Cyber Security Awareness Month: Week 2 “Phight the Phish”

“Phishing,” it may sound like a dance our teenage children are doing on TikTok, but it is far more serious and something everyone who works or plays online needs to be aware of.

Definition of phishing:
the practice of tricking Internet users (as through the use of deceptive email messages or websites) into revealing personal or confidential information which can then be used illicitly
www.merriam-webster.com

For week two of Cyber Security Awareness Month, we want to bring you the information and resources to protect yourself and your organization from phishing and spoofing attacks. These attacks occur when you receive a malicious email, website link, or text message on your smart device. Once clicked, your computer could become infected with malware or a virus. This can wreak havoc on your local machine, as well as the network on which you connect. Another consequence may be that you reveal personal information to cybercriminals, giving them access to bank accounts, or other sensitive, personal information. Often, these attacks are disguised as legitimate communications but don’t be fooled! Learn what to look for and how to prevent becoming a victim of a phishing or spoofing attack. The following tips are provided by the Cyber Security & Infrastructure Agency (CISA) and provide simple measures to help you avoid taking the bait:

• Play hard to get with strangers. Links in email and online posts are often the way cybercriminals compromise your computer. If you’re unsure who an email is from—even if the details appear accurate—do not respond, and do not click on any links or attachments found in that email. Be cautious of generic greetings such as “Hello Bank Customer,” as these are often signs of phishing attempts. If you are concerned about the legitimacy of an email,  call the company directly.
• Think before you act. Be wary of communications that implore you to act immediately. Many phishing emails attempt to create a sense of urgency, causing the recipient to fear their account or information is in jeopardy. If you receive a suspicious email that appears to be from someone you know, reach out to that person directly on a  separate secure platform. If the email comes from an organization but still looks “phishy,” reach out to them via customer service to verify the communication.
• Protect your personal information. If people contacting you have key details from your life—your job title, multiple email addresses, full name, and more that you may have published online somewhere—they can attempt a
  direct spear-phishing attack on you. Cybercriminals can also use social engineering with these details to try to manipulate you into skipping normal security protocols.
  
• Be wary of hyperlinks. Avoid clicking on hyperlinks in emails and hover over links to verify authenticity. Also, ensure that URLs begin with “https.” The “s” indicates encryption is enabled to protect users’ information.
• Double your login protection. Enable multi-factor authentication (MFA) to ensure that the only person who has access to your account is you. Use it for email, banking, social media, and any other service that requires logging in. If MFA is an option, enable it by using a trusted mobile device, such as your smartphone, an authenticator app, or a secure token—a small physical device that can hook onto your key ring. Read the Multi-Factor Authentication (MFA) How-to-Guide for more information.
• Shake up your password protocol. According to the National Institute of Standards and Technology guidance, you should consider using the longest password or passphrase permissible. Get creative and customize your standard password for different sites, which can prevent cybercriminals from gaining access to these accounts and protect you in the event of a breach. Use password managers to generate and remember different, complex passwords for each of your accounts. Read the Creating a Password Tip Sheet for more information.
• Install and update anti–virus software. Make sure all of your computers, Internet of Things devices, phones, and tablets are equipped with regularly updated antivirus software, firewalls, email filters, and anti-spyware.

You can report phishing attempts and spoofing by visiting https://www.ic3.gov. Learn about more ways to safeguard your information by visiting https://StopRansomeWare.gov.

All of this information is provided by the Cyber Security & Infrastructure Agency. We encourage you to share this information with your co-workers and staff. You can also download the pdf version provided by the CISA, and make it available to employees at your workplace.

To learn more about how CCP Solutions can help secure and protect your organization’s networks, visit our Barracuda MSP page, or contact us today.