When something smells phishy…

Is this ever going to stop? Truth is it doesn’t, and it gets clever – annoyingly clever. And when it comes to targeting the user’s naïveté – email spoofs are so aesthetically accurate & clickable to the naked eye, that once it lands on sensitive information, it’s sent out to do lots of things, mainly – infect & conquer! Posing empathetic when: asking to re-validate our membership information, leading us to a (copycat) website & lure to transfer money. Better yet, deceiving us at work, disguising attacks on attachments named, “invoice” or “signed contract.”

We’ve all been there – thinking twice when opening and replying legitimate messages. And while everyone’s expanding their resources, tools, & productivity when migrating to the cloud – more and more are susceptible to phishing attacks. So why not stay informed, as we break down some common phishing types we’re all exposed to; & what organizations say, is their biggest security weakness. Let’s also consider some email filters & solutions relevant to Office 365, beneficial phishing simulators (yes, we do those..) for organizations, & best practices to a healthier inbox.

Don’t click too fast!

The most common, and lethal as its regard is Deceptive Phishing. Sent with urgency, it targets your personal information & login credentials; impersonates the likes of your banks or e-commerce systems. It prompts the user with an alarming notion of discrepancies in the account & provides a link to a fraudulent site. Treacherous, as it’s almost identical to the official site (e.g., some may have interchanging words, or a having some misplaced letter). When in doubt: look for sporadic sentences in email messages, spelling & grammar errors, off-centered brand logo in salutations. Spear Phishing is where things get a little “personal.” Emails are formatted down to your name, phone number, company; using other viable information gathered from your socials. Once the visual trust is established, they hook you by clicking on a malicious link or attachment, intending to steal personal data. Other email attachments included in messages, usually disguised as a PDF file, using a file name like, “PLEASE PRINT” or “INVOICE READY” are often called, Malware-Based Phishing. Once clicked, it executes an attack infecting your machine & eventually finds itself spreading the attack to other workstations.

Bulk up your platform

While phishing campaigns creatively grow in celerity, so do client & server software protection. In the modern cloud, users reap the benefits of advanced threat protection features on productivity tools like in Office 365. This type of security model eliminates spoof messages before it reaches the inbox – where the message content, sender, subject title, hyperlinks, images, & attachments are scanned through an intricate test process that determines the message’s authenticity. On a macro-cloud spectrum, predictive analysis on attacks are calculated on the Azure platform as well – gathering abnormal behavioral analytics in how or when the next attack can happen, how deep into an organization’s network should the attack delve into, & what types of methodical phishing approaches will be used if such an incident should happen.

Another remedial path when combating phishing content is through the human experience. Real-time attack simulators have gone better in accuracy & beyond the security compliance testing; where some organizations partner with IT services & assimilate phishing test simulation, receive intricate results, & use these analytics to engage awareness in the workplace and train users to properly identify phishing attempts and to take the appropriate actions to notify the technical team.

Stay (IT) smart, get a second opinion…

One would agree that data breach exploits result from lack of training & responsiveness. When IT consultants are considered as part of the proactive process; brought in to assess an organization’s current security status, scaling optimal features up or down, & providing guideline solutions like, conditional access, identity & device protection, cloud application security (i.e., Office 365 Advanced Security Management), infrastructure backup, & status reports.

More on phishing prevention, identity information protection, & best practices? Have our FSi (Office 365 & Microsoft Azure) Cloud Experts assist in building a safer, more optimal business environment for you…