What is Phishing and what are its problems?
Phishing is a social engineering technique used to obtain confidential and sensitive information by masquerading as a communication from a trusted entity, such as a well-known institution, company or website. The malware is usually not in the communication itself, but in the links within the communication. That's why you have to be vigilant mainly in the mails you receive because it is the main attack vector. Even more so these days when many companies are working from home.
Phishing Scenario:
- The most common way is for victims to receive an email or text message "impersonates" a trusted person or organization, such as a co-worker, bank, or government office. or a government office.
- When the user opens the email or text message, they may be confronted with different messages in some cases are messages that try to scare you with the intention of undermining your good judgment by instilling fear.
- If a user falls into the trap and clicks on the link in the email, it sends them to a site that is an imitation of the legitimate one. from the legitimate one and asks them to register with their user credentials and password.
- If you do so, the login information gets to the attacker, who uses it to steal identities, loot accounts and sell personal information.
- Depending on the magnitude of the type of user, sometimes social engineering is also carried out to get to know the victim and the role he/she plays in the institution, with the aim of reaching high positions in the company . The purpose of this explanation is not to generate fear but to raise awareness.
When receiving an email or mail, check the source to detect whether it is trustworthy or not, especially in cases where sensitive personal information such as a password is requested.In case of falling into the trap, the first thing to do is to change all the access passwords to the different sites.
How do you detect if it's a phishing attempt?
- Check if we have received emails from that recipient.
- Check the domain (@.....)
- Spelling, grammar or mistranslation errors.
- Mails in another language.
- Suspicious links or attachments.
- Be wary of e-mails notifying you that you've won an incredible prize.
- Companies and banks never ask for sensitive data by mail.
Tips to avoid becoming a victim of phishing:
- Do not enter suspicious links sent by mail.
- Be careful if an email appears as spam, do not enable the images if you are not sure of their veracity.
- Do not enter bank pages sent through an email.
- If you access the link, check that it is a secure site (https with your certificate of trust).
- Do not use the same password for all sites.
Anti-phishing recommendations for companies:
- Train all staff.
- Phishing simulation to detect how effective the training was
- Use two-factor authentication whenever possible.
- Use password managers.
- Do not ignore security updates.
- It follows a policy of telecommuting.
- Do not write down passphrases for others to see (on a sticky note, for example), nor share them with anyone.
- Back up your important data so you can recover your files without having to pay for them.
We can accompany you in your end-to-end projects. Let's work together.
