Phishing is on the rise, and getting harder to detect.
Criminals have many objectives when launching phishing campaigns. These may include...
- Gaining access to your network
- Infecting computers on your network to create botnets
- Capturing passwords and banking information from you and your employees
Iowa Solutions recommends bringing up the subject of phishing, emphasizing the importance of using cryptic passwords, and overall security at every company meeting.
It's just good practice to remind all users - on a regular basis - of the risks, both to the company and to themselves personally.
Recently we received reports of phishing attacks pretending to come from within the company targeted. Users received an email from the system administrator on their own domain, asking them to reset their email password and providing a link that appeared to point to their own Exchange server.
Once a worm or virus is loose on your network, the damage and cost can be significant. Damage may include virus propagation to everyone in your company address books (including clients and customers), financial loss as a result of compromised online banking passwords, and the cost of cleanup which can run into thousands of dollars.
What You Can Do
- Require secure passwords of all employees and a policy that those passwords are changed regularly. (This usually can be set up on your server).
- Address security with everyone at every meeting, and instruct employees that receive any email requesting that they follow a link or reply with information like usernames or passwords that those emails should be forwarded to you. Under no circumstances should they act on them without approval from you and your IT staff.
- Keep all AntiVirus software up to date (Note: AntiVirus software can, unfortunately, lull people into a false sense of security. AV products do not do well detecting Phishing, and it's sometimes possible for a virus to strike before AV vendors have sent out updates to deal with it)
- Warn users that email from people they do not know, and email that seems to come from within their own domain, should be regarded with deep suspicion especially when such messages contain links or instructions that include disclosing any kind of personal information.
Iowa Solutions can often quickly identify if an email message is legitimate. When in doubt, err on the side of caution. Contact us if you are having trouble determining whether a particular email is legitimate.
Author: John