In this lesson,
we'll talk about how you can prevent phishing attacks
from occurring in your enterprise networks.
Now, these days, phishing attacks
have become one of the most persuasive attack vectors
used by attackers.
These phishing attacks and campaigns
focuses on tricking individuals
into revealing sensitive information
that can lead to significant financial loss
and data breaches in your organization.
However, by implementing the right strategies
and providing user security awareness training,
the threat of a successful phishing campaign
against your organization can be mitigated effectively.
An anti-phishing campaign
is an essential user security awareness training tool
that can be used to educate individuals
about the risk of phishing
and how to best identify potential phishing attempts.
These anti-phishing campaigns
typically involve some training being provided to your users
and then the performance
of a simulated phishing campaign against your organization
by an outside contractor
or software-as-a-service platform
that can provide your users with some practical experience
in spotting and responding to potential phishing attempts.
To help prevent phishing, your organization
should regularly conduct user security awareness training
that contains coverage of the various phishing techniques,
such as phishing, spear phishing, whaling,
business email compromise, phishing and smishing,
along with other relevant cyber threats and attacks
that may affect your organization.
This training should also highlight
the common characteristics of phishing emails,
including generic greetings, spelling and grammar errors,
and spoofed email addresses.
These security training programs
and their associated anti-phishing campaigns
should be an ongoing effort
since cybersecurity threats are continually evolving.
As part of these anti-phishing campaigns, your organization
should also provide in-depth remedial training
for any of your users who fall victim
to the simulated phishing emails.
Now, the best way to prevent being the victim
of a phishing attack
is to be able to recognize a potential phishing attempt.
There are some commonly used key indicators
that are associated with phishing attacks,
including urgency, unusual requests,
mismatched URLs, strange email addresses,
and poor spelling or grammar being used
in the emails received from an attacker.
First, we have urgency.
Phishing emails often create a sense of urgency
by prompting the recipient to act immediately.
For example, if a user receives an email
that states that they won a brand-new iPhone
but must click on a link to claim their products
within the next four hours or the offer will expire,
this is usually an indication of a phishing attack.
Second, we have unusual requests.
If you receive an email requesting sensitive information,
such as passwords or credit card numbers,
you should treat these emails with a lot of suspicion.
Remember, your technical support team
will never contact you
asking you for your login information,
and your bank will never ask you for your credit card number
over an email or a phone call.
Both of these kinds of requests
should set off an alarm bell any time you see them.
Third, we have a mismatched URL.
Did you know, when you see a website link in an email,
it doesn't always take you
to the place that it says it will?
When you're looking at an HTML-based email,
the words you are reading are called the display text,
but the underlying URL of the web link
could be set to anything you want.
For example, I can send you an email saying, "Click here"
and the words "Click here" are not a URL,
but the URL link to those words
might be for the homepage of diontraining.com.
Alternatively, phishing attacks
that rely on brand impersonation
often says one thing like paypal.com/login,
but when you click it,
you'll be redirected to a malicious URL
of paypal.hacked.xyz or something like that.
To check if the text-based link matches the underlying URL,
you should always hover your mouse
over the link in the email for a few seconds,
and this will reveal the actual URL
that the link is connected to.
If the text-based URL, like paypal.com,
doesn't match the underlying URL shown
when you hover over the link,
then it most likely is an email
that is trying to attempt a phishing attack.
While this is an old and simple trick,
users in our modern enterprise network
still fall for this technique time and time again,
so you and your users must always practice caution
when clicking on links inside of an email.
Fourth, we have email addresses.
When you receive an email,
you should always check the sender's email.
Just like a URL being displayed in the email,
the email address you see is just a text-based display name
and not the actual email address that sent the message.
If you want to see the real email address,
you can either hover over the display email address
or double click the display email address
to see the underlying email address.
If the real email address
and the displayed email address don't match,
then the email should be treated as suspicious
and possibly part of a phishing campaign.
Similarly, if the organization's official domain
is not used by the email,
or if the email address is overly complicated,
both of these are good signs that the email might be part
of an attempted phishing attack.
This is probably one of the most commonly used techniques
in phishing emails, and I see them
at least a few times a day in my inbox.
Whether the email is from a person
claiming to be a Microsoft tech support,
PayPal, the Amazon customer support team,
or a popular financial institution,
when I hover over the email and see that the email
is something like mr.weirdo578@yahoo.com,
I know this is clearly a phishing attempt,
and I mark the email as spam and move on with my day
without clicking on any of the links in the email.
Fifth and finally, we have poor grammar and spelling.
Most professional organizations
typically proofread their emails
before sending them out to customers.
If an email has a lot of broken English,
poor grammar, or numerous spelling errors,
it is likely to be part of a phishing campaign.
These days, though,
many attackers can write properly worded emails
without any grammar or spelling errors relatively easy
using generative AI, products like ChatGPT and Google Bard,
to avoid being caught
by this commonly sought after indicator
of a phishing attack.
With that being said,
you will still find a ton of phishing emails
that uses broken English, poor grammar,
and contain numerous spelling errors.
And you may be wondering why that is.
Well, the reason is simple.
If the phishing emails are too well done,
everyone will fall for it,
and this would simply overwhelm the attacker's ability
to act on the phished user's information.
So, many attackers have chosen to purposely include clues
that their emails are phishing emails
so that they can quickly weed out those
who are more suspicious by nature
and would catch their grammar and spelling errors.
This leaves the phisher
with only people who are more gullible
and are likely to be more profitable
for the attack over time
than users who are better trained and more suspicious.
So if you suspect an email is part of a phishing campaign,
what should you do?
Personally, I recommend
that you promptly report suspicious messages
to help your organization mitigate the risk
of a phishing attack being successful
against others on that network.
Each organization has its own policies,
which may include deleting the suspected phishing email,
forwarding it to your security team's inbox,
like phishing@yourdomain.com,
or procedures that your organization has chosen to use.
If you are working as a cybersecurity professional
and you are asked to triage potential phishing attacks,
you should first analyze the reported messages
to confirm whether it's a phishing attempt
using the commonly used and known indicators like urgency,
unusual requests, mismatched URLs,
suspicious email addresses,
and poor spelling and grammar in the message.
It is also important to inform all users about the threat,
as other users might have also received
a similar phishing email directed at your organization.
In your notification or broadcast email,
you should remind the enterprise users
that they should not click on any link
inside of the suspected phishing emails
or provide any kind of sensitive or personal information
to the attacker.
If the phishing email was opened
or any of the links in the email were clicked,
you should conduct a quick investigation
and triage all of the user's systems to determine
if there was any potential damage caused by the attack.
Lastly, if the phishing campaign was successful,
the organization should use this incident as an opportunity
to review and update their security countermeasures,
such as updating spam filters
or conducting additional user security awareness training.
So remember, preventing phishing attacks
requires a combination of effective training,
vigilance in recognizing phishing attempts,
and a swift response to reported suspicious messages.
By implementing these strategies,
individuals and organizations
can significantly reduce their risk
of falling victim to phishing threats.