Tag Archives: Phishing

Using Workers and Technology to Fight Phishing Attacks

SMB Technology, SMB Technology, SMB Technology, SMB Technology, Technology News, ,

Now that Generative AI (e.g. ChatGPT) is here, phishing attacks may increase both in number and sophistication. How do businesses protect themselves? Awareness is a good first step, but gathering data using a security information and event management system (SIEM) is even better. Read on to learn how SIEM along with education and awareness training can reinforce your company’s efforts to prevent phishing attacks and resulting malware.

 

What is SIEM?

 

Security information and event management (SIEM) combines two separate systems to not only gather information but develop rules to help analysts understand what occurs in your company’s network. Security information management involves the gathering, monitoring and analysis of security-related information across different computer logs–including email applications. 

 

Security event management is involved in helping respond to incidents. SIEM brings the two functions together – the strong log-keeping functions of SIM with the response capabilities of SEM. The information is put together in a standard format, then aggregated and analyzed, helping IT professionals prioritize their threat response. Since SIEM can be outsourced to managed service providers (MSPs), it is possible for small to medium-sized businesses to afford it and not have to hire extra staff.

 

SIEM and Phishing Attacks

 

The security operations center of an average organization can receive tens of thousands of threats, and some can receive ten times more. What’s a small or medium-sized business to do? How do they know they are victims of a ransomware attack until the damage is already done? Security information and event management has the capacity to gather and analyze information about user authentication attempts, separating normal logins from malicious attempts. When unusual login activity is detected, an event is created when it happens.  The SIEM software can then lock out the suspicious user while doing the investigation. While SIEM can show IT teams what’s happening throughout the network, everyone still needs to be aware of phishing emails and what they look like, and trained to act.

 

Train Your Workers, Too

 

Humans are thought of as  the weak spot in protecting against cyber attacks, including phishing emails. But what if, combined with SIEM, they are a strong defense against malware and other dangerous network intrusions? Whether phishing attempts using ChatGPT as the hook will become so sophisticated as to hide normal clues to phishing emails is not yet known. Clues like spelling errors and poor grammar are signs that the email is not from a legitimate sender. Educating workers to look for more information without clicking on malicious links and attachments, can help them identify a phishing email.

 

Technological tools like SIEM can combine with staff training to provide a strong defense against hazards from phishing emails. For further assistance, contact your trusted technology advisor today.

Keep From Getting Hooked by Phishing Attacks

SMB Technology, SMB Technology, SMB Technology, SMB Technology, Technology News,

Cyber attacks, including phishing attacks, seem to always be in the news these days. Ransomware, malware, data breaches, all are on the rise, with several high-profile attacks in recent years. Even more recently, the failure of the Silicon Valley Bank might promote spoofed bank websites and bank communications as attempts to gain access to company networks and personally identifiable information. Read on to learn more about the dangers of phishing attacks as well as how to recognize and prevent them.

 

The Consequences of Phishing

 

According to a 2021 CISCO report, many cyber attacks happen by way of fraudulent emails (and sometimes texts) wherein malicious actors masquerade as legitimate individuals or entities to get confidential information or to infect networks with malware. The sender of the email seems to be a legitimate sender, perhaps from a well-known company, or business the company has interacted with before. They may include an attachment appearing to be a PDF, or a URL in the body of the email. 

 

According to CISCO, nearly 90% of data breaches stem from phishing attacks, the majority of these attacks coming via email. Losses from these attacks are expected to reach $10.5 trillion by 2025–and the losses are not only financial. In addition to penalties for failing to comply with data protection regulations and loss of money through theft, reputational loss is a serious consequence. 

 

People’s dependence on technology for conveniences like e-commerce and gathering information online makes it easier for phishers to craft an email that appears genuine. How do you recognize what a phishing email looks like, and train your workers to identify one as well?

 

Training and Awareness Help Prevent Phishing Success

 

How do you know an email is genuine? What characteristics show that an email is a possible phishing attack? Through training in recognizing a phishing email, your workers will know how to deal with one. An urgent call to action is one trait, along with typographical and spelling errors in the body of the email. There may be differences between the sender’s email in the header versus the body of the email. Training can be academic, through the use of documents and infographics, short videos and meetings. 

 

Practice and Test Security Awareness

 

Another facet of training is practice, which can happen through phishing attack simulations designed to test knowledge. The results can then be used to target future training. It is best to conduct training on a regular basis; consider doing academic training quarterly and performing simulations spontaneously, to help keep the material fresh in everyone’s mind.

 

With training and practice, your company can easily and quickly recognize phishing emails and avoid the losses associated with attacks. For further assistance, contact your trusted technology advisor today.  

Stay Safe from Phishing Attacks

SMB Technology, SMB Technology, SMB Technology, SMB Technology, Technology News,

Many threats to your network abound, and often ransomware, malware and viruses enter your network through social engineering, or “phishing” emails. Read on to learn the extent of the problem and how you can keep your business from being affected by these threats. 

 

Phishing a Growing Threat

 

Social engineering attacks, including phishing, are among the greatest threats to individual users as well as small to medium-sized businesses. Even though giants like Google and Facebook get the headlines, small to medium-sized businesses are not immune. Anyone and everyone can be a phishing target, and these attacks often come through email, something people use every day. A malicious actor sends an email (perhaps appearing to be from someone the recipient knows), trying to get confidential information like passwords or trying to insert malware in the network. According to a CompTIA State of Cybersecurity report, it can cost $1.85 million to remediate a ransomware attack.  Often these attacks come through spam emails and contain dangerous links that, when clicked on, can introduce malware to your system. Spam emails, in fact, account for most of the ransomware attacks. In spite of the prevalence of phishing, many users are not aware of the risk; as many as 13.6% of recipients click on the link. 

 

How to Prevent Phishing Emails from Becoming Attacks

 

In spite of such daunting statistics, there is good news–more awareness about the dangers of phishing scams. Many companies are consistently and systematically training their employees, and those with more than eleven campaigns per year (on average, one a month), have a low click-through rate, only 13%. This awareness, along with using email solutions that filter out the spam responsible for many phishing attacks, can block the majority of phishing attacks and keep your network safe. It’s still wise to be prepared in case something gets through, and have data backed up off site for easy retrieval. Finally, you can train your employees to recognize a possible phishing email. Clues include addresses that don’t look real, spelling errors, poorly written content, and appeals to emotions like fear. Once your workers are on guard, they know not to click on dangerous links. If the email looks like it’s from someone the person knows, it’s good to check that the message is indeed from them. If not, the email can be deleted.

 

Though phishing attacks are growing more common (not to mention more sophisticated), many intrusions can be prevented with technological tools and employee training. To learn more about keeping your network safe, contact us today.

Tips to Avoid Security Breaches

SMB Technology, SMB Technology, SMB Technology, SMB Technology, Technology News,

According to a recent CompTIA report, even though people know what to do to avoid security breaches, they don’t always put this knowledge into practice. Employees can, however, take advantage of cybersecurity training in the workplace, learn to change passwords frequently, and implement other safeguards.

How to Identify a Phishing Scheme

The mouse arrow can be pointed at a suspected link exposing information you can use to identify an untrusted source. Another clue to be on the lookout for is a misspelling in the ‘reply to’ email address of the email. Third, hackers may use attachments that appear to be trusted (e.g., .txt or .doc)  to try to get personal information. Inspect the extension of the attachment to ensure they do not include “.exe” as this may launch a cyber attack as an executable program.

Be Aware of Spear Phishing

Spear Phishing is a form of social engineering designed to get you and your employees to divulge specific privacy information by using relevant and trusted information to influence your behavior. This could include banking, vendor, customer or other familiar information to trick you into providing account, password and other privacy data. Similar to phishing, these same clues can be a help in avoiding “spear phishing” attacks. You may also consider reaching out to customers, vendors or employees to authenticate an email’s source before taking action.

Monitor Your Network and  Use Security Information and Event Management Technology to  Cyber Attacks

There are many options to monitor your network for intrusions. Network monitoring can identify unauthorized access, unauthorized network login attempts, unexpected network traffic in terms of volume or time of day that all could point to Cyber Attacks. By using Security Information Event Management (SIEM) technologies, possible threats can be assessed, giving your business a holistic view of the most significant threats in real time. You may also consider penetration testing to simulate a cyber attack, in order to determine any vulnerabilities in your system and assess which ones are most crucial.

 

While technology can help deter cyber attacks, human beings always play a role in staying safe. Even if a phishing attempt is directed specifically at an employee, it can compromise an entire network. To learn more about how to respond to upcoming threats, contact your technology advisor today.

Hacking Hazards to Watch in 2019

SMB Technology, SMB Technology, SMB Technology, SMB Technology, Technology News, ,

The more technology advances, the more businesses must be aware of security breaches and hacker attacks. Where are hackers likely to strike in 2019, and how can you protect your business? Read on to learn more about new and existing cyberattacks to avoid.

Toll Fraud Likely to Threaten Businesses

Toll Fraud is an emerging cyber threat to watch out for. Toll fraud may happen when an attacker accesses your phone system to make fraudulent calls, possibly by posing as a new customer, placing calls (including expensive long-distance calls) directly from your business’s phone lines — on your dime! Cybercriminals may target businesses with in-house phone systems, rather than ones with Voice over IP (VoIP) systems. Toll fraud can be recognized and prevented through monitoring of a VoIP system.

Be on Look out for Phishing Schemes

Phishing typically uses emails to lure your employees into clicking on links that download malicious software (Malware). In addition, Phishing schemes may also get your employees to share internal information including passwords, confidential information, privacy information, financial information, patents and more. Educating your staff on how to recognize suspicious links and report them is your first line of defense.

Ransomware is Everywhere

Employees can also introduce Ransomware to your network, that can travel to all attached devices including your server. Once infected, you will be held ransom to regain access. If you pay, you are likely to be targeted again. Avoid ransomware by having strict policies to prevent thumb drives, guest PCs and other non-compliant devices attaching to your network. Having a reliable backup of your systems is a way to rapidly recover without paying the ransom.

While firewalls, anti-virus SPAM filtering, and penetration testing can help deter cyber attacks, human beings play a role in staying safe. To learn more about how to respond to upcoming threats, contact your technology advisor today.

Cyber Crime

Keeping Your Network Secure

SMB Technology, SMB Technology, SMB Technology, SMB Technology, Technology News, , ,

A network is only as strong as its weakest link, and if that weakest link is your security, that can compromise the revenue and the reputation of your business. Attacks just from ransomware have increased over the years, by 200% between 2015 and 2016 alone.  There are three fronts to consider: identify the hazards, use technical tools to protect your network, and educate your employees on cybersecurity. Read on to find out more about how to protect yourself.

Know the Hazards of Malware and Phishing Schemes

With so many businesses finding it necessary to gather, store and monetize customer data, this is an area of vulnerability. Malicious software, or “malware,” can take various forms, from worms and viruses to ransomware, which can hold your data hostage. Some types can simply make your system run more slowly, and some can steal or destroy data. Phishing schemes are designed to steal private data simply by an unwary recipient clicking a link. Technical tools are part of the protection plan.

Fight Cyber Attacks with Technology

There are plenty of technical tools and applications to keep your system safe. Firewalls and SPAM filters can keep unwanted network communications from coming in and going out. Anti-virus and anti-malware applications keep harmful worms, viruses and other malicious software from infiltrating your network. Be sure also to keep your antivirus and anti-malware programs up-to-date, to guard against the latest threats. Network monitoring can help stop attacks before they start, and operating system patches can fill in any security holes in the network. Along with these tools, be sure to train your employees to recognize security hazards.

Don’t Forget the Human Element

Employees can be the first line of defense against cybersecurity hazards. Teach your employees, through regular training, to recognize threats to your system’s security. Educate them to avoid “phishing” schemes by not clicking on links in email from suspicious sources, and how to recognize a suspicious email (often typographical or factual errors in the email are tip-offs). Finally, emphasize that cybersecurity is a team effort, and get them invested in helping keep your network safe.

Remember, your business is only as secure as your network. You are risking more than money if your network contains weak spots. Contact your technology advisor for assistance with protecting your network’s security.

How to Avoid Being a Ransomware Hostage

SMB Technology, SMB Technology, SMB Technology, Technology News, , , , , , , , , , , ,

RansomwareRansomware, spyware, phishing schemes, and other Cyber attacks are commonplace in today’s world of technology. According to a recent article in Forbes, ransomware attacks grew at an accelerated pace in 2016 with reports of 638 million attacks, almost 200 times more than the number of ransomware attacks in 2015. Most experts agree that Ransomware attacks will continue to occur–so what can you do to avoid being a ransomware hostage?

Not All Ransomware is Created Equal

Before you panic, find out what type of Ransomware you are up against. Scareware is a type of Ransomware that tricks you into thinking you have a bigger problem. A simple scan may quickly remove the pop from your browser cache and get you back on your way. Some ransomware is truly nasty — your entire system may be encrypted, meaning you will need to wipe your system and start over if you have a good backup. Otherwise, you may find yourself hostage to the cybercriminals to unlock your data.

An Ounce of Protection is Worth a Pound of Ransom

Data protection is an important element in minimizing the impact of Ransomware. Make sure your network security is fully compliant. Backup your data, update your antivirus definitions and make sure your security patches are up to date. Consider using Cloud Backup, Security as a Service, and Managed IT services to keep your network up to date. Having a strong offense to avoid ransomware is your best defense.

Don’t Forget the Human Element

Train your employees on a regular basis on the importance of staying vigilant against Cyberattacks and how to avoid being a hostage. There are many resources to get training for your team. Periodic updates about threats and security procedures serve as a reminder to your employees to ensure they adhere to best practices.

If you need security training or are interested in a review of your network, security vulnerability, or other technology infrastructure, contact your Technology Advisor today.