This post is also available in: English
Web security is a subject that deserves user’s attention, since it is where the biggest challenges for IT professionals are concentrated, and they seek to reduce vulnerabilities in the network. Maintaining security in the global computer network and in corporate environments is a task that may be highly complex, requiring investments in security assets, addressing perimeter, email, endpoint, and other standards, such as ISO 27000.
In this post, we will cover Phishing (a variation of the word fishing) which is a type of fraud – usually initiated with the sending of spam in order to obtain information from users, such as passwords and credit card numbers, and often cause financial damage to these users. In this article, we will present the main characteristics of Phishing attacks, as well as forms of protection against this threat, so common in Internet.
How does an attack occur?
Usually the attack begins by receiving bank emails (bank phishing), or any other source that gives a trusted impression, with links to be accessed. Any call that generate curiosity is a way to attract people: ‘click on the link and see the exclusive photos I sent you’, ‘you are being demanded’, ‘click on the link to download the ticket’, and ‘get the tool to change the color of the Facebook screen’, are some of the best known.
Phishing e-mail can direct the user to a fake website or popup window, prompting them to pass on the data of interest to the fraudsters, or even injecting malicious code onto the user’s computer so that information is captured automatically sent to malicious users.
How to protect against phishing attacks?
The market offers some tools, such as antivirus, that can be useful in detecting a threat. However the best way to protect yourself is to prevent these spam and dubious messages from being accessed, and therefore, within a corporate environment, the perimeter protection strategy is always very important. Firewalls and anti-spam will help in this process.
Do not visit websites through links sent from dubious emails
URLs in emails can be a way to insert viruses and other malicious agents into computers. So avoid this practice, and rely only on known senders. Banks, financial and legal agents send urgent notices by letter, court orders, or suggest customer contact in person.
If in doubt, ask
If the user is in doubt whether the email actually belongs to the mentioned institution, the best solution is to contact through a reliable number to clarify the problem. If the communication is real, it is possible to take necessary actions without great risks.
Do not respond to emails that ask for data
The user should avoid responses with personal data such as ID and credit card number. Doubtful offers and rewards are the first warning sign for danger: statements like ‘you just need to respond to that email with your personal information to earn a free supermarket year’ show that the chances of phishing are great.
Keep your computer healthy
Keeping the operating system and applications up-to-date is a way to prevent attacks. Developers are constantly looking for flaws and making fixes to prevent malicious users from taking advantage of these vulnerabilities.
In-company phishing protection
Companies should also care for the health of their equipment and promote a safe environment for employees. It is an advisable practice, if there is a turnover in the use of equipment, to prioritize the use of administrative email. Firewalls and anti-spam are also fundamental in this regard.
Within a corporate environment, phishing threats can bring about difficult recoveries, so prevention must be done in two ways: by educating employees about security practices that prevent the occurrence of claims associated with phishing and by implementing solutions that minimize the receipt of this type of e-mail, as well as protecting the asset (computer) from possible contamination by virus, triggered by the action of phishing.
To avoid receiving unwanted emails, including phishing, the company can use anti-spam solutions, which, by applying security layers, prevent these emails from reaching users’ inboxes. It is worth noting that other security solutions can also aid in the process of shielding the corporate network against this type of incident, as is the case of antivirus and derivatives that can act directly in the endpoint.
Even if a user receives a certain e-mail and clicks the malicious link, a good proxy policy in a UTM firewallmust detect the URL as a threat and prevent access, therefore ensuring that even in the user’s misunderstanding or lack of knowledge, the attack is unsuccessful.
If your company needs information to avoid phishing and data theft, contact our sales team! We have a number of products that can assist in maintaining the security of your corporate network.
This post is also available in: English
