What is phishing?
Phishing is the use of a fraudulent email or electronic
communication to get a person to perform an action.
Phishing is a social engineering tactic that is
often a component of an information security attack.
Social engineering can be referred to as attacking the human.
The human is commonly the weakest link in the security chain.
From the attacker's point of view,
it can be easier to trick an employee into performing an
action than it is to circumvent a control.
For example, getting an employee to divulge their password can be easier
than decrypting or guessing that same password.
There can be many different motivations for the attacker.
These motivations may include financial gain, revenge,
or political agendas.
The level of sophistication is dependent on the motivation,
resources, and the skills of the attacker.
Some attacks may be easily spotted whereas a state
sponsored attack may have significant resources to carry out the attack.
There are three major categories of social engineering.
There are electronic, telephonic, and in person.
Of the three, fishing is the most common.
Fishing is common because it is easy to do,
there are no geographical limitations, and it works.
With any type of social engineering method,
there are some common attributes that draw suspicion.
Urgency, severe ramifications,
name dropping.
Specific attributes of phishing will be discussed next.
Phishing is when an attacker uses email or or other
electronic communication to get a person to perform an action.
When a phishing email is targeted or tailored to a specific person,
it is referred to as spear phishing Because the request
includes detailed or specific information,
the request may appear legitimate.
As a result, spear phishing is more likely to be successful.
Whaling or whale phishing is when the attacker employs spear
phishing tactics on a high value target like an executive.
The following steps will help minimize the impact from
phishing attacks.
Be on the lookout for suspicious emails.
If you suspect a phishing email,
do not perform the action requested.
Verify the legitimacy of the message via other means,
such as a phone call to the requester using a known number.
Do not download or open any attachments included in the suspect email.
Do not use links in an unverified email.
Go directly to the source.
Do not ignore any warnings from your computer.
If you do receive a warning, be very cautious.
The warning may be part of the scam.
Contact your security or IT staff.
Do not perform any actions stated in the warning unless
you are positive it is an appropriate message.
Report any suspicious email or computer behavior to your
security or IT personnel.
Smishing involves using text messages to send phishing type emails.
The characteristics and prevention methods are the same
as for email phishing.
The following are some best practices to prevent or
minimize the risk from phishing.
Verify any suspicious request via trustworthy means.
Do not rely on any contact information provided by the requester.
Do not download or open any files provided in a suspicious communication.
Do not forward any suspicious communication to anyone other
than proper personnel such as security or IT personnel.
Report suspicious activities to appropriate personnel,
such as security or IT personnel.