Spear-Phishing Prevention: Five Steps to Thwart Online Scams

Spear-phishing isn’t going anywhere, and the malicious practice can pose a real threat on an organisational level.

IT professionals should employ a multifaceted approach to phishing prevention, with thought given to education, infrastructure and social media practices. Follow these five steps to give your enterprise the best chance to defend all attacks.

Check the Integrity of Links in Inbound Emails

A newer spear-phishing trend is the transmission of unique malicious links in the body of an email. These unique links are deployed in an attempt to get around existing internet security, which can recognise a previously-identified malicious URL and block it.

Sandboxing infrastructure can mitigate this risk by pre-checking what happens at the other end of the link and blocking them from delivery.

Inspect Your Web Traffic in Real-Time and Work to Change Behaviours

Your web security gateway must be up-to-date and capable of real-time monitoring.

Spear-phishing attempts can target personal email accounts that are accessed while the user is at work, bypassing the inbound link filtering identified in the previous step, so ensure your organisation is prepared for this possibility.

Remember too, that the most extensive internet security can be compromised if users have poor attention to security.  Ongoing training and employee testing is the best practice to guarantee safety.  We work with products that can identify the most at-risk personnel in your team, highlighting the need for extra security training.

Test These Behaviours with Simulated Spear-Phishing Attempts

Once training has been conducted, IT professionals can hammer their point home by conducting penetration tests across an organisation. Select targets from across all departments, and attempt to get them to click on simulated phishing links (ensure you only use readily available information from targeted social media sites, just like a hacker) to see if you can get a click.

Track the results and explain to employees that have been seen to engage in risky behaviour what has occurred and what they must do to follow best practice going forward.

Deliver Varied Phishing Prevention Messages

Take into account the disparate learning preferences across your organisation, and think of different delivery methods for phishing information. Some employees may prefer ongoing video messaging and webinars, whereas others may benefit from in-person training or regular email blasts.

Inform Employees When Major Breaches Occur Elsewhere

It is hard for employees to appreciate the importance of phishing prevention without them seeing it first-hand. Ensure that relevant industry breaches are communicated to employees in full, and explain exactly how the data breaches occurred.  Engage your marketing department to get them to “sell” the message internally.

Of course, these are a few connected suggestions for defeating phishing attempts.  For a comprehensive approach to securing your network, talk to Computer One.  We’re a leading IT consulting company with offices in Brisbane, Sydney and Melbourne.