Big news, folks. This week, two deeply researched reports by Verizon and Symantec Corp are being released and what they have found about cyber security breaches is as follows;
“The vast majority of hacking attacks are successful because employees click on links in tainted emails, companies fail to apply patches to known software flaws, or technicians do not configure systems properly.”
Boom. So what this means basically is this; the curtains veiling the smoke and mirrors touted by the media in order to make hackers look like geniuses can quickly be pulled back to reveal that these cyber security breaches just aren’t all that sophisticated. What it really comes down to is the responsibility of the company to make sure that not only is their IT environment successfully managed, but that their employees understand the basic risk that is “phishing.”
Phishing. It is a phrase we hear rather often in the news – but do you actually know what it means? Phishing is the security industry’s term for trick emails. Now think about all those times you’ve heard that term; that means there are A LOT of trick emails floating around.
While many of us may consider ourselves smarter than your average “trick email,” I’m sure that very same “us” has a handful of co-workers that will openly admit they probably wouldn’t know the difference. Let’s face it; we aren’t all Millennials who grew up with a free Hotmail account that ONLY received trick emails (and the occasional chain email, of course).
Here’s some basic tips to consider:
- Do you have ties with this company? Always, always, start here. Take a moment and think; do I have an account with this company? Have I done business with this company? If you get an email from UPS asking for information – have you personally just shipped a package from UPS? Even if you have – they won’t ask you for info over email, but that’s another story. Just take a moment to think about if it has anything to do with you. This can eliminate a ton of issues right here.
- Be suspicious of any email with “urgent” requests for personal, account, or financial information. Emails may ask for “verification” or you could risk losing your account, etc. Once again, do you even have an account with them? If so, call them up and ask if this is legitimate. But I haven’t come across a single company that asks for personal information over email this way.
- Don’t even click on links in emails. If you aren’t sure; just type in the web address yourself to your browser and log in to your account yourself. If there’s any alerts or anything you should be aware of – your account will notify you once you are there.
- Don’t download or open attachments. Unless you know it’s that report you’ve been waiting on from Bob in over in accounting – don’t even do it. If you don’t recognize the sender or know exactly what it is about – don’t open it.
- Don’t send any personal information via email period. Just don’t even fill out forms in emails. It’s so widely understood to be a security threat to ask for information via email that companies just do not do it. Even if you click on something (which you won’t because of #3) in an email that takes you to a web page with a form to fill out – just don’t do it.
- Report suspicious emails. All of our customers should forward suspicious emails to the Support team so the proper steps can be taken if it is a threat. (Even if it turns out to be OK we are happy to help).
- Lastly; help each other out! If you have a co-worker that may not be as well versed as yourself in phishing scams, go over these tips with them – tell them you’d be happy to look at any and every possibly suspicious email. And vice versa; don’t be afraid to speak up if you aren’t sure about something.
Photo via: Allstate.com
Info via: Reuters.com, SEC.gov