The digital revolution has introduced a new reality for all its users, namely companies and consumers. The internet has enabled radical progress in many business areas, not least online commerce (or eCommerce). However, not everything has remained positive and, today, cyber attacks are a concern for everyone who uses the internet.

What is phishing?

The concept of phishing comes from the English word "fishing", in other words, the hacker casts "bait" in order to "fish" for information about those who "take the bait".

It consists of tricking users into revealing personal and confidential data through the use of technological methods, in most cases by sending emails. In these emails, the hacker poses as a trustworthy company or organisation, thereby gaining the recipient's trust and trying to obtain certain data. They can often imitate a website, for example a bank's, and prompt customers to log in with their username and password. If the person does this, they will hand this information over to the hacker.

In this type of situation, the data most commonly targeted for theft is personal information such as passwords, credit card numbers and bank account details. This is the simplest form of cyber attack, but it can also be the most dangerous.

Phishing Emails

These are emails in which attackers present themselves as trusted colleagues or other contacts in order to deceive the unwary into handing over passwords or other information. They are easy to send and hard to combat.

Many of the largest data breaches in recent years, from the attack on Sony Pictures to the intrusion into the Brazilian Democratic National Committee and several attacks on banks, began with phishing emails.

Types of phishing attack

The MalwareBytes website has identified some of the most common types of phishing, which are:

1. Spear phishing

This type of attack requires prior knowledge of the entity being imitated, in order to create a credible persona and email and take advantage of the situation the person is in. Unlike the vast majority of cyber attacks, it targets a specific individual rather than the masses. This is the main concern of companies and governments.

2. Clone phishing

This involves copying or cloning emails previously sent to that user, but the hyperlinks and attached files are swapped.

3. Phone Phishing

This attack takes the form of a message or, in most cases, a call. The attacker poses as a bank or service company, presents a problem and offers their services as a solution, always involving a payment or money transfer.

4. Nigerian scams (419)

In this situation, hackers pose as members of a royal family or government who want to make a very large money transfer. The urgency of the situation is quickly stressed, leading the recipient to disclose their details. It is associated with the number 419 because that is the section on fraud and crimes in the Nigerian Criminal Code.

How can it be prevented?

The first way to prevent an attack is undoubtedly to install some protection, for example more comprehensive antivirus software that prevents phishing. However, although this is a reliable method, it is not completely effective, so there are a number of good practices you should bear in mind.

• If you recognise the sender's name but it is someone you do not communicate with by email, try to contact the person in question before opening the email.
• If the message content has rather strange links, or even attached files, do not click or open them; hover over the link to check its URL and see whether it is safe. In addition, pay attention to the content itself: if it is alarming and marked as urgent (or this is even mentioned in the subject line), be suspicious and try to find out where the email comes from.
• Also analyse the context, as no bank or even tax service will ask you to review your personal and account details by email.
• Use the old "wrong password" trick: when a site asks for your password for the first time, deliberately enter the wrong password and check how it behaves.
• Check the addresses that appear in your browser's address bar and confirm they are genuine; if they have dubious names, do nothing, simply close the page.
• Search for the organisation on Google and check that the website is the same.
• If in doubt, call the real organisation and check with your bank, customer or whatever the original entity is. Check whether the email is genuine and, if not, report it, as they will know what to do.
• Adopt a more complex and secure password.
• Configure your security/privacy settings on Facebook and other services and use two-factor authentication systems: if you do not receive a confirmation code on your phone after a "ghost login", you will realise something went wrong and can change your password without fear that access to your account has been compromised.
• If in doubt, do not forward emails unless expressly asked to do so by the person, because if you have doubts and it is a real threat, you could be spreading it; call the organisation to check the authenticity of the email.

The costs

In cases where a breach resulted in the loss of data or assets, the average cost of a cyber attack on a company rose in 2018 to 4,845 €, according to the report.

Where to start?

Protection against these breaches, or attacks, requires both technical controls and good staff awareness. This includes non-specialist employees, who are typically the ones targeted by phishing attacks.

The role of employees

The 2019 Cyber Security Breaches report by the University of Portsmouth also concludes that, as in previous years, the most disruptive breach or attack was most likely to be detected by the company's own staff.

Final considerations

Some SMEs feel they could do more, but are not sure which measures to follow and want guidance on other improvements they could make.

Others feel they had already adopted a reasonable approach given the fixed resources and budget they have. Social solidarity institutions with low to medium incomes, in particular, see cost as an obstacle.

Some organisations also mention the need to balance user controls with the flexibility to allow staff to carry out their day-to-day tasks, so that they do not feel excessively controlled.

Ensure your company's security

Openlimits guarantees all its customers a strong security component in the digital environment, through UTM equipment (for network monitoring and filtering), hybrid backup systems (local and in the cloud), and a professional email service with content filtering and the creation of blocking rules.

We help our customers to protect against, detect and respond to threats by carrying out systematic security operations, minimising the impact on your company in the event of any attempted attack such as phishing, ransomware and more.

Your security is what matters most to us. Discover our offer.

Written by:
Openlimits

Tell us what you think