From ransomware to SolarWinds, the cybersecurity space has been as fast-paced as it has ever been over the last 12-24 months. However, for all of the emerging threats and news that are cropping up on the horizon, phishing -- one of the oldest pain points in cybersecurity -- is continuing to quietly wreak havoc and is as big of a threat as it has ever been.
Phishing has been a mainstay in the cybersecurity threat landscape for decades. In fact, 43 percent of cyberattacks in 2020 featured phishing or pre-texting, while 74 percent of US organizations experienced a successful phishing attack last year alone. That means that phishing is one of the most dangerous “action varieties” to an organization’s cybersecurity health. As a result, the need for proper anti-phishing hygiene, a culture of awareness, and best practices is an absolute must.
With that in mind, here are a few quick best practices and tips for dealing with phishing threats:
Know the Red Flags
Phishers are masters of making their content and interactions appealing. From content design to language, it can be difficult to discern whether the content is genuine or a potential threat, which is why it is so important to know the red flags. Awkward and unusual formatting, overly explicit call-outs to click a hyperlink or open an attachment, and subject lines that create a sense of urgency are all clues that the content you received could be from phish and indicate that it should be handled with caution.
Verify the Source
This may seem obvious, but all too often using strong passphrases/password managers are overlooked. People spending more time online during the pandemic has certainly contributed to more bad actors prowling for accounts to attack. Using long, complex, and unique passwords is a good way to prevent your account from being hacked, and an easy way of keeping track and remembering your passwords is by using a password manager. It is especially important to not reuse passwords across business and personal accounts.
Be Aware of Vishing and Other Phishing Offshoots
As more digital natives have come online and greater awareness has been spread about phishing, bad actors have begun to diversify their phishing efforts beyond traditional email. For example, voice phishing -- or vishing -- has become a primary alternative for bad actors looking to gain sensitive information from unsuspecting individuals. Similar to conventional phishing, vishing is typically executed by individuals posing as a legitimate organization -- such as a healthcare provider or insurer -- and asking for sensitive information. Simply put, individuals must be wary of any sort of communication that asks for personal information whether it be via email, phone, or chat -- especially if the communication is unexpected. If anything seems suspicious, again, break off the interaction immediately and contact the company directly to confirm the integrity veracity of the communications.
Phishing may be “one of the oldest tricks in the book,” but it is still incredibly effective. Although it may be hard to spot in the midst of a phishing attempt, by exercising caution and deploying these few fundamentals, individuals and organizations more broadly can drastically mitigate the chances of falling victim to a phishing attack.