The Five Key Steps for Organizations to Stop Phishing Attacks

Some weeks ago, there was an attempted hack into the phone contact list and emails of some UK MPs. This prompted the deputy chief whip Christopher Pincher to issue a warning to his colleagues, imploring them to:

Please be wary of texts and / or emails purporting to come from colleagues asking you to provide overseas contact details and / or asking you to download a secure message app.

You can read the full story here.

This story is important because it shows how phishing is still a popular tool that cyber criminals use to gain unauthorized access to personal and corporate networks. Data shows that the average user receives 16 malicious spam emails per month. Now, let’s say you only have 30 employees, that’s 480 times a month you have to trust their ability to scrutinize emails correctly and make the right call.

Quite frankly, you probably won’t be able to stop phishing attacks on your company or employees. However, there are things that you as a proactive business leader can do to help ensure that these attacks when attempted are not successful:

Implement a Phishing Awareness Training Program

While technical defences are necessary to keep you secure the vast majority of successful attacks are due to human error. This is why employee education and security awareness training should be a priority. Employees should know:

• Not to click suspicious links as well as the damage that can happen if they do
• The importance of verifying the security of the websites they visit and how to do that
• The dangers of using public Wi-Fi to access company systems or platforms
• Never to give out their personal information
• The usefulness of checking their online accounts, updating their passwords, and keeping their browsers up to date

Run Simulated Phishing Campaigns

Running effective simulations to test how Phish prone your employees are is key to understanding what needs to be done. These tests would help you identify those that require training and also see if your training is actually reducing the propensity of your staff to click on phishing emails. Simulating phishing can greatly increase the resistance of your employees to potential phishing scams and prevent cyber criminals from gaining unauthorized access to confidential information and disrupting your business processes.

Make Sure All Systems Are Up-to-date

One of the reasons software developers release regular updates is to keep users safe from cyber threats posed by criminals who exploit holes in codes. As quickly as software providers find ways to fix exploitable holes in their software, cyber criminals & hackers (who are always active and up to no good) find new ones to exploit. To prevent and limit the damage caused by a phishing attack, it is important to make sure that all software is up-to-date and that the IT team gets the chance to regularly review the structure for any potential issues.

Implement Comprehensive Spam Filters

While the latest commercial spam filters still won’t catch 100% of the spam emails entering the company’s email accounts, they will prevent the vast majority.  The standard filters employed within Outlook and Gmail will not offer the requisite level of protection as they’re simply designed to catch common spam messages, and not the newest and latest threats from phishing scams. And that is why you need a sophisticated comprehensive spa filter to help detect both run-of-the-mill phishing attacks as well as spear phishing emails.

Harness Monitoring Software

Monitoring software should be used to highlight the potential for a phishing threat. The latest software is now designed to alert IT teams when a user clicks on a suspicious link or traffic levels differ significantly over a short period time. Software can also point to specific flaws within the company, helping teams to identify areas of concern and ensure that any common problems are resolved.

The rise in the occurrence and sophistication of phishing means that every organization should be proactive in how it attempts to mitigate these attacks. Because phishing primarily targets people, employee education and empowerment remains a crucial part of any defense strategy you have in place. You need to start thinking about the People side of your cyber security strategy and how you can transform your employees into a human firewall system, effective in their ability to function as a last and critical line of defense on cyber-attacks.