Request a Quote
How to Avoid Phishing | How to Prevent Phishing Attacks
February 8, 2021
Avoid Getting Phished
Email phishing attacks are common; chances are you’ve been a victim. It could be anything from the prince of Nigeria to winning a 10 Million lottery! We all have our share of stories about the different types of phishing scams we have been through.
Phishing attacks remain frequent and user education is the best defense, despite improved detection and prevention methods.
Business owners should ensure their team stays updated and knowledgeable about email phishing campaigns. Almost every week there is news about phishing campaign stealing. Scams cost Australians more than $100M a year and this is just the reported amount, quite sure the amount which is not reported would be quite more than what has been reported.
The Australian government is doing a great job and regularly publishing information [https://www.cyber.gov.au/acsc/register] One can register as an individual, business, or large organization at [https://www.cyber.gov.au/acsc/register] and be kept in the loop, They even have a quiz about the same.
But still, a lot still needs to be done!
Why are Email Phishing attacks so common?
Email phishing attacks are simple to execute and rely on volume; sending thousands of emails increases the chances of success.
In short, email phishing attacks are of two types:-
- Tricking users to click on links in the email leads to spoofed websites and then passing on sensitive information. Or
- Tricking users to click on links in the email to install malware on their machine.
Many businesses rely on their local chamber of commerce as a trustworthy source of advice and guidance.
We ran some quick tests on the members of the chambers of commerce and the numbers can speak for themselves
| Total Members | Passed | Fail | % | |
| Greater Springfield Chamber of Commerce | ||||
Step 1:- Engage the professionals to avoid phishing
While this is not the 100 % fix, engaging a professional will leave your business in a much better position.
Understanding all the technical bits can be time-consuming and entertaining, we would recommend you focus on running your business and let us focus on running your IT.
Let’s engage the professionals and get them to do their job properly.
You need a strong technical partner in your team to leverage IT to grow your business.
Send us an email via this LINK with your domain name and we will run some tests and provide you with Technical assurance.
We often encounter situations where an ex-employee deletes all emails and empties the deleted folder, resulting in the loss of emails, even if they are in the cloud.
Businesses still turn revenue into millions but neglect IT (Information technology), leaving their technical sides without an IT partner to look after them.
Step 2:- Train users against phishing
The best form of defense against email phishing scams is user training.
No matter how good your IT Support provider is if the user just clicks that link knowingly or unknowingly, it can get a bit tricky.
Hence training users is super important, Get your team members to register at https://www.cyber.gov.au/acsc/register/individuals-and-families and have some sort of checklist process so that new team members are also registered.
This way the user is provided with up-to-date information and can make educated decisions when they are in front of a spoofed email.
And sign up all team members to the free email alert service by Cyber.gov.au as it is up-to-date and easy to understand.
Have a look at the below video which is less than 3 minutes and it beautifully explains, We also send the link to this video when we onboard a machine for our customers, This way we are refreshing/training the users just to make sure they think before they click.
Link to the video https://www.youtube.com/watch?v=XEtvwzN_xJk&feature=emb_logo
Simulated phishing attacks can identify vulnerable users and reveal areas that require more user training.
Running the simulated phishing attacks is super easy and there are some free tools out there as well.
Spear phishing causes 80%+ of data breaches by users clicking links, preventable.
Quick points
- Think before you click on a link.
- Stay informed about the latest phishing attacks.
- If you are unsure, never give out personal information and
- Keep your machines up to date. (or leave it for the professionals)
Step 3 – The Non-Techie Stuff Verify the documentation
For example document processes for bank account changes and invoice terms.
Include the following payment terms in invoices, purchase orders, and other relevant documents.
“ No changes to be made to banking or personal details without first being verified directly by phone with a nominated individual from our organization and please call the tele no as per our website or XXXXX ”
If you are transferring funds to any business account query any changes to the bank account and ensure that there is verbal and written correspondence. Verify your records and confirm the correct phone number, as the number in the document may be fraudulent.
Have a checklist process in place and have it reviewed regularly to ensure that team members follow the right process especially when there is a change of banking details request.
Step 4 – The Techie stuff
Skip technical details by following Step 5’s guidance on initiating a conversation for assurance.
Now the boring techie stuff!
- DMARC Record:- What it is and why is it important
- SPF Record:- What it is and why it is important.
- DKIM Record:- What it is and why it is important.
DMARC Record:- What it is and why is it important
What it is- DMARC (Domain-based Message Authentication, Reporting & Conformance) is a way to authenticate your mail server and to prove to ISPs, mail services and other receiving mail servers that senders are truly authorized to send an email.
WHY it is important- Implementing SPF makes it harder for hackers to conduct domain spoofing phishing attacks, as unauthenticated emails can be easily detected and blocked.
HOW to implement it- This can be added to your DNS via a TXT record such as the sample record below.
Name:
_dmarc.edgecatering.com.au.
TXT Record:
v=DMARC1;p=quarantine;sp=none;adkim=r;aspf=r;pct=100;fo=0;rf=afrf;ri=86400
SPF Record:- What it is and why it is important.
What it is- An SPF record (Sender Policy Framework) is used to indicate which hosts are authorized to send mail from a domain for your mail server.
WHY it is important- Having an SPF record can be invaluable as it will prevent hackers from sending out emails that aren’t from your mail server with your domain address. An SPF record can prevent hackers from disguising their domain as yours, as it blocks unauthorized emails lacking proper authentication.
HOW to implement it- Similarly this is a TXT record that can be easily added to your DNS records. See the sample below for an example.
Name:
Domain.com.au.
TXT Record:
v=spf1 include:spf.protection.outlook.com -all
DKIM Record:- What it is and why it is important.
What it is- Public key encryption is used by DKIM records (Domain Keys Identified Mail) to allow the recipient of the email to verify that your domain was sent and authorized it.
WHY it is important- Having a DKIM record will help to protect your domain against email spoofers by validating emails sent out by your domain. Furthermore, public key encryption can verify the integrity of an email and detect tampering while confirming its sender and domain.
HOW to implement it- This is the third and final TXT record you will want to add to your DNS server and will look similar to the one below.
Name:
Default._domainkey.domain.com.au.
TXT Record:
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw1psAF54fc+sGFIek+kJ0KP2WDqBqlwnMrXvszDsyBUPfKjrWIabl357kOqCAdkVKnvh6dLv4+O3ZMAsocSpTaw/JjrSugOcxVTa6xI2aEfMgXO0DAfxjb5oS7Yv8LUErSVl3mnGY6UaS1aSzcpT65sSIfvzGQo8/NXOQP3bVwrgqutgRYCI4nWBbe47pfipeZTaCfzDo2afI5+6ERrW56pNQsr1nuML9cZzCocJGjeoWTCHd6IIoRZ7bYiBf3PJFJN0zqIikzLGdpz5dzS6e6YhAznvKGXrqe6I1pvYDdT3mfZsJr0Zf8oNowSwZOaXjYoBE7oQ/8x+lyYes/w8QwIDAQAB;
Step 5 – Next Step – Let’s do quick some quick free tests for you
Want to know if your domain is in need of protection? Submit your domain through our website LINK and we will do a quick free test for you to let you know if you are protected. However, we’re a small team and may experience delays in responding, but we’ll do our best to reply promptly.
We’ve created a simple email template for you to forward to your IT provider regarding phishing protection.
“Hello (your name),
I’d like to confirm that we are taking appropriate measures to safeguard against phishing attacks.
A reliable source recently shared advice on reducing the risk of a phishing attack on (your website URL).
If you can kindly verify from your end as well that would be much appreciated.
Eddie Vedder
Eddie looks after marketing campaigns for Ironclad. In his pre-tech life, he worked as a journalist on the San Francisco Peninsula. Off hours, he dreams of England.