Phishing isn’t going away, it’s evolving. And the User?
With our current attention span -9 seconds – and email overload, not every employee could become a phishing detective.

We are only human and can be manipulated.  Therefore, you should expect to receive occasional phishing emails.

Now, internal security controls must decide and test to block and deal with the resulting disaster. This means that malicious procedures following activation of phishing payloads are prevented, detected, and addressed.

https://youtube.com/shorts/MGhVe_gj8E4?feature=share

Remember: Think Before You Click. #TBYC

[EYE OPENER] Phishing attacks increased by 61% compared to 2021.
So far, 255 million attacks this year!!

Security Magazine wrote this week about SlashNext’s recent disclosure report on scams. “SlashNext analyzed billions of URLs based on links, attachments, and natural language messages across email channels, mobile devices, and browsers over six months in 2022 and found over 255 million attacks. attack, or the rate of phishing attacks increased by 61% compared to 2021.

Findings from SlashNext’s State of Phishing 2022 report highlight that previous security strategies, including secure email gateways, firewalls, and proxy servers, no longer stop threats, especially as malicious actors increasingly launch these attacks from trusted servers and from personal and work email clients. “

Key findings from the report include:

Cybercriminals are redirecting attacks to mobile and personal communication channels to reach employees. SlashNext has seen a 50% increase in attacks on mobile devices, with scams and credentials theft topping the list of payloads. In 2022, they detected an 80% increase in threats from trusted services such as Microsoft, Amazon Web Services or Google, with almost a third (32%) of all threats currently hosted on trusted services. 54% of all threats detected by 2022 are “zero hour” threats, showing how hackers are changing tactics in real time to improve success and scientific services and their information technology.

If it’s urgent, don’t let your emotions cloud your judgment.

If you get an urgent email from your boss, a text from your bank, or see a great offer on Facebook, take a moment, let your emotions cool, and read it out loud. Does this make sense, could it be a phishing email? Scammers are running out of time too, they need you to act fast before they realize you’ve been scammed. So don’t let them!

Call and Verify!

One of the best ways to combat a phishing attack is to make sure you’re talking to the right people. For example, when you buy a house, someone could spoof your attorney’s email and send you information about fake wiring. So call and check.

Check the Address

Always check email addresses and URLs for typos. Whenever you need to log in, it’s best to enter the URL manually instead of clicking the link in the email. While spell checking in the sender’s address is a MUST, it’s not enough, as there are ways to spoof an email address to make it look like the real one. So whenever you need to take action, such as sending sensitive information, transferring money, or going online, make it a habit to call the sender and verify.

Enable Multi-Factor Authentication

Let’s say you got scammed by an email scam and they got into your gmail account they can now start hitting “reset password” on your other apps and guess the link where to reset password? Your gmail account is hacked. And that’s why passwords are not enough to protect your digital life. We need a second authentication method or what is commonly known as multi-factor authentication. This is when you need to enter the code after entering the password to complete the connection. This code is sent to your phone or generated by an app that generates a new code usually every 45 seconds. This way, even if your password has been stolen, they don’t have a second code to enter. Many apps have this option, but it’s disabled by default, you can usually find it in settings -> privacy or security and find Multi-factor or two-factor authentication. Using an authenticator app is the preferred method, as scammers have also found a way to trick you into giving them a code that has already been sent to your phone. Microsoft or Google Authenticators are two apps you can download from the App Store that will generate these codes for you.

Look at the Style of the Message

For example, is the style of the email different from previous emails you have received from this particular person. Are you waiting for this email? Does it make you anxious, stressed, excited, happy, or any other emotion that makes you want to do something?

Ask Questions

If the suspicious message is from a family member or friend, you can ask simple questions that only you and them know. If it’s your CEO or someone you don’t directly report to and you don’t feel comfortable calling them, talk to your manager.

Security Awareness Training

Cybersecurity education and habit building are essential. The more you know about scams, the better you can spot them. Security awareness training will include practical stories and tips that can help us protect our digital lives wherever we are – at work or at home.

BE AN EMAIL SUPERHERO, THINK BEFORE YOU CLICK!!