Phishing is the number one gateway to cyber attacks

From ransomware to the SolarWinds attack, the cybersecurity space has been more hectic than it has ever been over the last 12-24 months. How hectic?  In 2019, a total of twenty-one 0day vulnerabilities were found “in the wild”. In 2020, that number increased to twenty-six and (so far) this year, there have been fifty-two. However, for all of the new tricks, tactics and emerging threats, one of the oldest pain points in cybersecurity is continuing to quietly wreak havoc.

Despite often being overlooked in terms of hype, phishing has been a mainstay in the cybersecurity threat landscape for decades. In fact, phishing accounted for more than 80 percent of reported security incidents and 74 percent of US organizations experienced a successful phishing attack last year alone. That means that phishing is still one of the most dangerous attack vectors when it comes to an organization’s cybersecurity health. As a result, the need for proper anti-phishing hygiene and best practices is a must. With that in mind, here are a few quick best practices and tips to help you fight the phish.

Know the Red Flags

Attackers are masters of using social engineering to entice you to click a link. From content design to language, it can be difficult to discern whether content is genuine or a potential threat, which is why it is so important to know the red flags. Awkward and unusual formatting, overly explicit call outs to click a hyperlink or open an attachment and subject lines that create a sense of urgency are all hallmarks that the content you received could be malicious and should be handled with caution.


Verify the Source

‍Phishing content comes in a variety of ways; however, many phishes will try to impersonate someone you may already know -- such as a colleague, service provider or friend -- as a way to trick you into believing their malicious content is actually trustworthy. Don’t fall for it. If you notice any red flags or sense that something may be out of place or unusual, reach out directly to the individual to confirm whether the content is authentic and safe. If not, break-off communication immediately and flag the incident through the proper channels.

‍

‍Scan Links and Attachments

‍If the content you received doesn’t have any glaring red flags, when it comes to cybersecurity, it’s always best to err on the side of caution. Taking a moment to hover over a link to see where it actually taking you or scanning an attachment from your computer has the potential to save you hours of damage control.  Vigilance is even more important on mobile devices; security best practices such as hovering over a link or viewing a full email header to reveal a sender’s address are not possible and due to the small form factor, misspelled words and fuzzy logos are less noticeable.


Be Aware of Vishing and Other Phishing Offshoots

‍Attackers have diversified their phishing efforts far beyond traditional email. For example, voice phishing -- or vishing -- has become a primary alternative for bad actors looking to gain sensitive information from unsuspecting individuals. Similar to conventional phishing, vishing is typically executed by individuals posing as a legitimate organization -- such as a healthcare provider or insurer -- and asking for sensitive information. Simply put, it is imperative that individuals be wary of any sort of communication that asks for personal information whether it be via email, phone or chat -- especially if the communication is unexpected. If anything seems suspicious, again, break-off the interaction immediately and contact the company directly to confirm the veracity of the communications.

Phishing may be “one of the oldest tricks in the book,” but it is obviously still incredibly effective. And although it may be hard to spot when you may be in the midst of a phishing attempt, by exercising caution and deploying these few fundamentals, individuals and organizations more broadly can drastically mitigate the chances of falling victim to a phishing attack.