Phishing is a very major problem in the online world and something that has become increasingly common as more businesses turn to internet-focused business models or tools. While it might not be the most initially destructive risk, it can still be a serious issue and something that you want to be prepared for.
What is Phishing?
While many people know vague details about phishing and what it involves, many businesses just assume that it is a general term for any hacking risk. However, ‘phishing’ specifically relates to a certain type of social engineering technique, one used to steal login information or bank details.
Phishing can be a serious concern for any company since it can be used to get access to information that is not meant for the public. Successful phishers might be able to access private servers, spend company or customer money, or even delete and alter files on your system as they please.
Of course, phishing can come from many different sources and have many different purposes. Some do it purely for fun, others do it for money, and a few may even have active malicious intent towards your company specifically. Some phishers simply want to cause chaos and will steal funds or data only if they happen to find it.
Understanding Phishing
Phishing covers a wide range of different methods and tricks that might be pulled on your company and knowing the specifics of some of them can really help. Identifying phishing is not always hard, but it only takes one unaware employee or mistake for something to go wrong.
Invoices
The simplest (and most popular) phishing attack is for the phisher to simply send fake invoices, usually ones that appear to be urgent (and often have some kind of veiled threat associated with them, such as arrests). These rely on people being too worried about the urgent nature of the invoice to double-check before paying it.
These will usually go to finance departments or sometimes higher-up employees that might not be aware of which services the company has not actually paid for yet.
Expiry Emails
Like invoices, expiry emails are meant to prey on people who get worried about potential risks. They usually claim that some vital service has expired (or is about to expire) and that another year of service or coverage needs to be paid for again.
These will usually have login links to a fake version of the service’s site. If you sign in and log into the account, then you are actually giving away your login details, which can allow the phisher access to your account if you do not change your login details immediately.
Prince Scams
The famous ‘Nigerian Prince Scam’ is widely mocked, but it also works very often. These scams ask you to accept some money for safekeeping until a major figure in another country can escape their own – but accepting will just get your own funds stolen instead.
SMishing
Smishing, or SMS phishing, is a variation of phishing that relies on text messages, something that can be a lot harder to double-check than emails. Since texts are usually quite snappy and short, they often demand a quick reply, so employees are likely to accidentally take the bait.
Knowing how to avoid smishing is hard, especially if you have older employees that might not be as tech-literate as more recent hires. It is much easier for a user to click a link via their phone, and users are more likely to read the message itself, which can lead to a higher amount of responses.
All of the same techniques that apply to email systems apply here, only with a greater risk of somebody falling for it. If your company mobile phones are directly (or even just indirectly, but closely) tied to systems used within the company, this gets even more alarming.
Fake Co-Workers
Sometimes a phisher will make up fake emails or texts from other departments or people within your company. Even if they do not steal a real name, they can use it to try and inject malware or get login details for important tools that you use.
You can usually check these details against the other emails you might have received from them, allowing you to make sure that it is not from a real co-worker. However, if it did come from the real email address, then your email system may already be compromised.
Other Methods
Really, there are countless different social engineering tricks that can be used for phishing, and no easy way to categorize them. All of them are aiming for valuable information or login details, things that could be very dangerous for your business to give to a random presence outside the company.
It is important that your employees are educated on how to recognize phishing, how to prevent it, and what measures can be taken to avoid it. However, your company also needs to have an active role in combating it.
Getting Help
While your company can tackle smaller-scale phishing attempts on its own, there is always a risk for something getting through, and it only takes one unlucky success for a phisher to infiltrate your network. From there, they could cause multiple major breaches within the company.
If you can’t handle everything yourself or are not even sure how to start educating employees on what they should do, then turning to third-party companies can help a lot. This makes training employees easier and keeps your attention free to work on other projects or goals instead.
Understanding and recognizing phishing is the most powerful way of preventing it from harming your business: a single employee can be a vector for a company-wide breach. Proper education and experience are the best defense, and the more your employees know, the better.
You could also get help with running simulations or drills on employees. Many companies believe they are safe, only to run a simulated phishing attempt and find out that over 50% of their employees are willing to give up login details without even double-checking the email’s sender or asking their boss about it.
