Skip to main content

To Phish or To Be Phished

What is Phishing?

Phishing is the fraudulent attempt to obtain sensitive information such as usernames, passwords and credit card details by disguising oneself as a trustworthy entity in an electronic communication. Typically carried out by email spoofing or instant messaging, it often directs users to enter personal information at a fake website which matches the look and feel of the legitimate site.

What is Spear Phishing?

Spear-phishing is a targeted attempt to steal sensitive information such as account credentials or financial information from a specific victim, often for malicious reasons. This is achieved by acquiring personal details on the victim such as their friends, hometown, employer, locations they frequent, and what they have recently bought online. The attackers then disguise themselves as a trustworthy friend or entity to acquire sensitive information, typically through email or other online messaging. The main difference betwen Phishing and Spear Phishing, is Spear Phishing is very precise and very targeted in nature. 


How can you prevent any potential damage of phishing to your brand? 

  1. Develop and run in-house internal user awareness program to computer security regularly
  2. Over communicate the risks and dangers of phishing to your external customers and suppliers
  3. Buy all possible spoofable domain names to protect themselves and their suppliers and customers. To make things worse, all web url and email are underlined
    • user@woman.com become user@vvoman.com  (w is replaced by double v)
    • www.woman.com become www.wornan.com (m is replaced by r & n)
    • www.catgirl.com become www.catqirl.com (g is replaced by q)
    • www.google.com become www.qooqle.com (g is replaced by q) 
    • It is expensive exercise to do. There are endless combination of these domain.

How can you do to migitate the risks of the impact of phishing?

  1. Change password at least once a year
  2. Enable 2FA/MFA for your email accounts (via sms or mobile apps authenticator)
  3. Enable Windows Defender Browser Protection for Google Chrome Browser
  4. Enable mail identity protection on your mail server
  5. Install a reliable and effective endpoint security software for your PC or Notebook. We recommend that you can try Kaspersky Endpoint Security Cloud Plus. It has Mobile Security and Security for Microsoft Office 365
  6. If you are using Office 365 (O365) or Microsoft 365 (M365) then you should enable Office 365 Advanced Threat Protection. It has Safe Links, Safe Attachments and ATP anti-phishing protection
  7. Put in internal control checks to manage any external request to change bank account number
    • Check Domain with Domain Dossier https://centralops.net/co/DomainDossier.aspx 
    • Insist on Offical Signed and Stamped Document   
    • Land Phone Verification 
      • Use a verified telephone number taken from namecard
      • Do not use the telephone number taken from the email

Comments

Post a Comment

Popular posts from this blog

How SME overcame the challenges of COVID-19?

  The COVID-19 pandemic has cause global health emergencies, and a global economic slowdown. Trade, investment, and employment are all been affected, and the crisis will have an impact on economy. The development of COVID-19 outbreaks affects various sectors with a scale of loss that tend to be very broad and in different sector. The sectors most affected are trade, tourism, transportation, education, and health. Small and Medium Enterprise (SME) are the most threatened group of entity because they may not have the resources to survive the crisis.     The first challenges that SME facing is their sales without any doubt. Many businesses were forced to shut down during this pandemic after the government-imposed MCO / Circuit-Breaker restrictions and lockdown.  For businesses that were able to operate or re-emerge today, many are facing significant challenges complying with the requirements ordered by the government and health authorities. Moreover, the physical ...
Post a Comment
Read more

Cloud Sync let you sync your Data from NAS to Cloud Storage

Cloud Sync let you sync your Data from NAS to Cloud Storage Cloud Sync  Cloud Sync integrates the advantages of public cloud and private cloud, enabling you to effortlessly connect your Synology NAS to public cloud services, such as Amazon Drive, BackBlaze B2, Dropbox, Google Cloud Storage, Microsoft Azure, OpenStack Swift, and more. Seamless synchronization between private and public clouds Cloud Sync enables you to seamlessly connect your local Synology NAS to public cloud services or on-premise storage through Amazon S3 API, OpenStack Swift, or WebDAV protocols. With Cloud Sync, you can enhance the collaboration when accessing between your local NAS and other remote cloud services, and can efficiently and easily back up data from or to public clouds. With Cloud Sync, you can seamlessly sync and share files among your Synology NAS and multiple public cloud services, including: Alibaba Cloud Object Storage Service (OSS) Amazon Drive (end of support as of November 1, 2020) Amazon S...
Post a Comment
Read more