Phishing
Download the white paper
The Threat from Phishing
Phishing aims to persuade people to click on links to install malicious software or visit fake websites. It is mostly done by email, but it can also include phone calls as well as text and social media messages.
Phishing attacks appear to be genuine emails from a trusted company or person. However, they hide their real intention. This can be to steal confidential information like passwords, money or cause business disruption. Given the volume of emails that businesses receive it can be hard, even for trained experts, to spot a phishing email.
A business may be targeted by cyber criminals in a phishing attack or it could be part of a larger campaign that is directed at many organisations and businesses.
How Advanced Threat Protection Can Protect Your Business
Phishing emails are more convincing than ever. The tell-tale signs of the past - spelling mistakes, grammatical errors or poor design are now less common. When a convincing email drops into the inbox of a busy person, they can easily click the email before they realise the risk. By that time it is too late, the damage is done.
What can a business do to protect its emails?
Traditional spam filters handle many phishing emails by moving them to the spam folder. Relying on this leaves two weaknesses though:
- People can move emails back out of the spam folder.
- It is also possible for the criminal to send an email with a link to a legitimate page, but then change the destination. The criminal switches the website for a malicious one, between sending the email and the recipient opening it.
Advanced Threat Protection mitigates these risks, by rewriting email links to take them through a secure proxy server first. When the user clicks the link, the contents of the link are checked instantly and are blocked if they are malicious.
It also performs an in-depth analysis of attachments on a security server in a process known as ‘sandboxing’. This protects the individual and the business from attachments which may contain ransomware or be part of a phishing attack.
The Threat from Email Hijacking
Email hijacking is a type of ‘man-in-the-middle’ attack.
As the name suggests, criminals sit digitally between a business and everyone else online. This allows them to read all emails, including confidential information, before sending them on to the correct recipient.
The business is unlikely to be aware of this behaviour. However, the hackers are building up detailed information about the business, its clients, projects and security.
Whilst spying is a serious issue, the next stage of the attack is even more damaging. Hackers use their new knowledge to impersonate the business and change information in the emails.
For example, to alter bank details on invoices so client payments are made into the criminal’s bank account rather than the business’s.
A 2017-2018 report from the National Cyber Security Centre and the National Crime Agency, found that business email compromise was the third most common way that criminals defraud a company.
How Email Security Can Protect Your Business
Email Security
Email is not secure by default and is relatively easy to intercept and monitor.
Email encryption is essential when exchanging sensitive information, both internally and with third parties. This ensures that only the recipient can view the contents. It can also prevent the recipient from forwarding the message.
Domain Name Protection
To avoid email hijacking it is critical for a business to protect its domain name. This is the business’s registered name for its website (www.businessdomainname.co.uk) and email addresses (name@businessdomainname.co.uk).
Without security for the Domain Name System (DNS) it is possible for cyber criminals to bypass protections and hijack emails. An IT security partner will secure and manage a business’s DNS. It will use security controls, including Multi-Factor Authentication to help verify a business, keep it secure and reduce fraudulent email.
Cyber Security to Protect Your Business
Learn more about how to keep your business safe in the white paper: Cyber Security: How to Protect Against Complex Threats.
This plain English guide from Always Secure covers:
- The cyber security threats facing professional services firms
- The risks and opportunities from new technology
- How to protect and support a business with cyber security
- An effective strategy to protect your data, devices and systems
- What to look for in an IT security partner