Ruri Ranbe has been working as a writer since 2008. She received an A.A. in English literature from Valencia College and is completing a B.S. in computer science at the University of Central Florida. Ranbe also has more than six years of professional information-technology experience, specializing in computer architecture, operating systems, networking, server administration, virtualization and Web design.

Image source: Getty Images

When we hear the word “cyberattack,” we usually envision a high-level threat at a global corporation that seeks to steal credit card information or intellectual property. But one of the most common forms of hacking, known as phishing, is carried out through faux emails sent to unsuspecting employees at smaller businesses.

Symantec’s 2018 security report found smaller businesses had more instances of these attacks than larger enterprises: Companies with less than 250 employees averaged one in 323 instances, while companies with 1001 to 1500 averaged one in 823.

It’s a good bet most of your employees don’t know what phishing is or how to detect it, yet they’ve probably received a fishy email at some point. Phishing scams may fly under the radar of many threat-hunting efforts, so the most effective way to combat these attacks is promoting employee awareness and vigilance.

Overview: What is phishing?

Phishing refers to cyberattacks carried out through communication outlets. The attacker contacts the target via email, text, or telephone and attempts to collect personal information allowing them access to sensitive personal and financial data. The information often is used in subsequent identity and financial theft.

The good news is many phishing attacks can be prevented by educating yourself and employees about common methods, so you don’t fall prey to impostors. The bad news is you’ll need to rely on educating yourself and your employees, so you don’t fall prey to these impostors.

Types of phishing attacks

All types of phishing attacks rely on “social engineering.” In terms of cybersecurity, this means using personal information and outreach to coerce an individual into exposing more personal information that can be used against them, usually for the attacker’s financial gain.

Despite repeated warnings from IT staff and widespread coverage of such scams in the media, it’s amazing how often even the savviest individuals fall for these tricks.

Deceptive phishing

In deceptive phishing, the most common type of phishing attack, the attacker impersonates a trusted company or contact via email and asks the victim to share credentials. These attacks are random, and the emails are sent to large numbers of potential victims.

The emails often request the recipient fill out a survey or direct them to click on a link to rectify a discrepancy in their account. The emails usually end with a dire warning urging the recipient to act quickly to avoid serious consequences.

Although this may be the least sophisticated of cyber scams, it is often the easiest to fall for, as the emails will incorporate legitimate links to the organizations they are spoofing. Tell-tale signs of fake emails are spelling mistakes, incorrect grammar usage, or email addresses, unlike the real organization’s domain name.

Spear phishing

Spear phishing is much the same as deceptive phishing, except the attacker is targeting a specific individual or company, usually out of a personal grudge or vendetta. Typically, the attacker has already collected some information about the target via social media or a simple Google search.

The goal is to inflict maximum damage, so rather than simply accessing social security numbers or bank accounts, often the threat actor seeks to install malware or ransomware in your network that can cripple and even bankrupt some businesses.

Whaling

Whaling uses similar phishing techniques as mentioned above, but the target is usually a high-level or public figure, such as a member of the C-suite. The attacker’s methods need to be a bit more polished, however, since many high-profile targets are well-trained in cybersecurity matters. Additionally, many don’t handle their email or phone calls directly, instead relying on their executive assistant to do so.

The main difference between whaling and spear phishing is the higher stakes involved: The threat actor may trick the target into initiating wire transfers, exposing intellectual property, or accessing a customer database rife with valuable information that can be sold on the black market.

Vishing

Vishing (short for “verbal phishing”) extends the ruse to phone contact. We’ve all clicked on a link at one time or other that triggered a pop-up message reading, “Virus Alert! Your computer may be infected. Call 1-888-XXX-XXXX to speak to a technician.” That’s a tried-and-true vishing tactic.

Once you call the number, the “helpful” technician will ask all kinds of questions about your computer, your contact info, account information, and other personal details, so they can “follow up” on your issue.

Attackers may also place unsolicited calls from unknown numbers. Sometimes they pretend your car was involved in a crime (they’ll have the license plate number or vehicle description) or they claim to be a government agency threatening to suspend your social security number if you don’t comply with their requests for information. Never give out information to unsolicited callers.

Smishing

Smishing is similar to vishing, except it happens via text (the name comes from mixing “SMS” with phishing). Often, these texts will appear to come from your bank, requesting your account or bank card number for verification. Or they may appear to be a friend sending you a link to check out -- a link that will infect your phone with malware when you click on it.

Users often fall for these scams easily because when they use their mobile phone, they likely are on the move and paying less attention. Additionally, people make the mistake of thinking phones are more secure than their computers and laptops. Think again.

Angler phishing

Angler phishing is probably the most targeted of all phishing scams. The attacker poses as a customer service rep and reaches out to people who have complained about a company on their social media accounts. These scams are particularly effective because most consumers post their complaints because they want the company to respond.

When that very convincing rep reaches out, the customer is more than willing to share account information, expecting a refund, future discount, or bonus. This is a common ploy for hackers seeking sensitive financial information, as research has found that 55% of angler phishing victims think the rep contacting them is from their financial institution.

6 phishing protection tips to help protect your small business

While it may sound as if phishing scams are everywhere you look, they may be among the easiest to prevent or at least mitigate. You can do so without expensive technology or disruptive solutions. Your first step in developing your phishing security strategy is educating yourself on what a potential threat looks and sounds like so that neither you nor your employees invite a hacker into your business.

1. Educate employees

The No. 1 tip for protecting your business from phishing attacks is educating your employees. Do it immediately and do it often. Teach them what a phishing attack is, how it can impact the business, and how to differentiate between a real email and a fake:

• Advise them to never give out personal information over the phone or via email.
• If they receive a suspicious call, recommend that they ask for a callback number and try phoning the caller.
• Remind them to hover on links before clicking them, examining the web address for misspellings or unknown domains that don’t match the purported company.
• Warn them not to share personal info on social media.
• DO NOT open any attachments from senders you don’t recognize.

Stay abreast of the latest phishing emails making the rounds (a quick Google search should tell you what you need to know) and inform employees of the details by sending out an email, posting a memo in the breakroom, and announcing it in staff meetings.

Some employers find it helpful to create a mock phishing email to send to employees to test the effectiveness of training. If an employee falls for it, they sign up for additional security training.

There’s no such thing as too much security training, even if employees whine it’s repetitive. In the throes of a busy workday, even the most conscientious employee could click a link without thinking. The constant reminders could help you avoid devastating consequences.

2. Use a spam filter

This is an easy one. Your email application most likely provides one, and you may have set up additional permissions when you created your email server and employee email accounts. Spam filters will filter out suspicious emails, so employees don’t have to make judgment calls on possibly nefarious communications.

3. Keep all security patches current

Remind employees to close out of applications and shut down their computers at least once a week. This ensures their computers and other devices will update to the most accurate versions of firmware, which usually deliver security patches that address newly discovered vulnerabilities. If you have onsite servers, be sure your IT team is regularly patching infrastructure software as needed to keep data and other assets safe.

4. Two-factor and multifactor authentication

Guarding against phishing attacks is just one more reason to deploy two-factor or multifactor authentication for all connected devices. Consider it the Energizer Bunny of preventing cyberattacks, because just about every how-to article on good cyber hygiene, standing up endpoint security, or IoT security recommends it.

If a hacker gets an employee’s password to log in to your network, it’s doubtful they will also have access to that worker’s phone, ultimately fending off a breach of your systems.

5. Deploy antivirus software

This is another tactic critical to securing your network and systems. If an employee clicks on a malicious link that delivers a virus or malware to your systems, the antivirus software will identify it and remove it, again mitigating a breach before any serious negative impact to your business.

There are free antivirus software options out there, but they rarely offer complete and thorough protection. There are a number of affordable choices, however, so with a bit of research into the best endpoint security platforms and endpoint detection and response (EDR), you’re sure to find an option that’s a perfect fit for your business needs.

6. Use a VPN

Requiring employees to log into your network through a VPN may offer the best possible protection against phishing scams. VPNs can detect malicious websites, prevent hackers from monitoring an employee’s web browsing, and prevent phishing emails. In this day and age, if you connect to the internet, you should do so through a VPN.

The best phishing defense is common sense

Phishing schemes are effective because they prey on the wild card of your security strategy: your employees. You can help them operate safely by providing technology that is armed with software, firewalls, scans, and other built-in mechanisms that automatically defend your network and systems.

But it’s up to you to train them on using these tools and promote hyper-awareness through ongoing training and frequent reminders. People are, after all, only human, and with all of the distractions in today’s work environments, it’s easy to overlook even the most obvious of tricksters.

Based in the live music capital of the world, Tammy Columbo continues to work in the information technology industry as she has done for more than 10 years. While living in Austin, Columbo has contributed to high profile projects for the State of Texas, Fortune 500 technology companies and various non-profit organizations. Columbo began writing professionally in 2009.

I have a confession to make: I’m not usually blown away by the antivirus software I review.

Over the years, I have learned to expect certain things from these applications, and I have not been terribly surprised by most versions that have crossed my desk.

Certainly, definitions evolve, and the means of detection improve. But for the most part, antivirus software works its magic by comparing what it sees with a static set of definitions, then taking action when it identifies a match. The interface may become more intuitive, deployment more painless and detection more accurate, but the process itself remains largely unchanged.

But the latest iteration of Symantec Endpoint Protection (v.12) was a pleasant surprise. With SEP, Symantec changed direction.

Advantages

Symantec seems to have gone to great lengths to Excellerate overall performance by training the software to avoid scanning files unnecessarily. To achieve this, it has introduced Symantec Insight, technology that uses data collected from more than 175 million opt-in customers to rate the safety of and assign reputations to almost every executable (.exe) file available. The virus scanner uses this information to decide whether to scan a given file. When a reputation ranks highly, the application will skip it altogether, effectively minimizing scan times and lowering overall system resource utilization.

Additionally, the latest rendition of Symantec Online Network for Advanced Response (SONAR) introduces policy enforcement, which helps block new malicious processes before definitions become available. This is accomplished by observing a program’s behavior in real time while leveraging its actions against a behavioral profile. If the culmination of several suspicious actions results in a poor rating, the system will proactively stop the process and prevent it from further compromising the machine. Any administrator who has wrung her hands (or pulled his hair out) while waiting for a virus definition update will no doubt appreciate this added layer of malware protection.

Why It Works For IT

The management console is well designed and easy to learn, providing tools and data for the entire organization in a single panel. Administrators who have used previous versions of SEP will find the layout and logic familiar, as it is strikingly similar to that of v.11. Most common tasks can be carried out in much the same way as they always have been, from creating custom policies to deploying to new clients. Any administrator familiar with this product family will have no problem getting up to speed with changes in the new version.

To help, Symantec preconfigures the policy settings of the Small Business Edition of SEP 12. That means administrators can hit the ground running, making customizations as needed.

Last, but far from least, because Insight reduces the files scanned and the duration of scans, SEP 12’s performance is noticeably improved on client systems, resulting in a better overall experience for end users.

Disadvantages

Though the Small Business Edition boasts advances, they come at a price. The product becomes much cheaper when an organization passes the 25-client mark, and customers receive additional discounts for longer subscription terms.

Symantec Corp. (Nasdaq: SYMC) today announced its global Symantec Sales Expert training program marking the latest enhancement to the unified Symantec Partner Program.  Effective July 24, 2006, Symantec channel partners will have access to five new, complimentary sales training modules and assessments via Symantec’s online partner portal, PartnerNet, followed by 13 additional sets that will be released by August 4 through a phased approach to ensure quality and consistency as Symantec introduces the unified training program.

The first round of new training modules and assessments is part of an ongoing schedule of new training modules and assessments that will be available to partners on a quarterly basis via PartnerNet.  The new training program offers a more streamlined process for partners to achieve sales accreditation on Symantec’s security and availability products.  Upon successful completion of each assessment, partners will earn status as a Symantec Sales Expert (SSE), validating their extensive knowledge on that specific product offering.

“The new sales training modules are designed to impart product knowledge and best practices to help our partners succeed,” said Julie Parrish, vice president, Symantec Global Channel Office.  “This new training and accreditation program leverages feedback from our partners to create a globally consistent framework for validating and rewarding their investment in our business.  As a channel centric company we are continually striving to build upon our Symantec Partner Program to ensure that we bring increased revenue opportunities to our partners.”

Global Symantec Sales Expert Training Program
The cost-effective sales training program provides partners with accelerated training development and validation on point products.  The training modules take into account learning style preferences in a flexible manner to support our partners’ regional requirements and market segmentation efforts.  The training modules and assessments, which take approximately one hour to complete, will allow partners to build toward future equity and benefits in the Symantec Partner Program.

The first five training modules and assessments include Symantec Control Compliance Suite, Symantec Bindview Policy Manager, Symantec IM Manager, Symantec Mail Security for SMTP, and Symantec Configuration Manager.  The additional training modules available to partners by August 4 include market leading products such as Symantec Antivirus, Symantec Client Security, Veritas NetBackup, Veritas Storage Foundation, Symantec Sygate Enterprise Protection, Symantec Backup Exec System Recovery, and more.

Partners confident in their knowledge and sales experience on a particular Symantec product can complete the online assessment without completing the training course to accelerate their time to accreditation as a SSE.  Partners that have received accreditation from past product training and assessments can complete the new product assessment, once it becomes available, to receive accreditation as a SSE in the new program.

“The new sales modules will allow MSI Systems Integrators to be more efficient in the training process so we can continue to focus on boosting revenue by selling Symantec’s industry leading products to our customers,” said Doug Thompson, vice president of Strategic Alliances, MSI Systems Integrators.  “As a Gold partner, we look forward to completing training courses and assessments and advancing our membership level to receive additional benefits.”

Partner Locator
In addition to the newly updated sales training program, Symantec has expanded its current Partner Locator eligibility to include Silver level partners.  Symantec is currently preparing the Partner Locator Advanced Search option with information on customers’ business needs obtained from its 60,000 partners worldwide.  With the Partner Locator Advanced Search option, which will launch later this year, customers will be able to easily narrow their search for partners by region, products, market focus, etc., thus providing partners with increased business opportunities.

Symantec Partner Program
In March 2006, Symantec launched its unified partner program (http://www.symantec.com/partners/index.jsp) and partner portal, PartnerNet, that streamlines and simplifies processes for its more than 60,000 global partners, while providing them with the resources to deliver value, meet their customer’s needs, and to expand their portfolio of market leading solutions.  All current Symantec partners, including former VERITAS partners, were placed into the new partner program and mapped into one of the four membership levels – Platinum, Gold, Silver, and Registered – based on their activity in prior Symantec and VERITAS programs.  Partners will continue to invest in driving revenue, market demand and increasing their technical competence in order to maintain or increase their membership level in the new program.  Symantec plans to deliver an automated points-based system early next year to facilitate program tracking.

“We have received very positive feedback from both our partners and the channel industry on the Symantec Partner Program,” said Parrish. “Throughout the partner program integration process, our partners’ feedback was imperative in the success of the initial launch, and we will continue to incorporate their feedback to enhance and deliver a program that our partners find beneficial to the success of their business.”

About Symantec
Symantec is the world leader in providing solutions to help individuals and enterprises assure the security, availability, and integrity of their information.  Headquartered in Cupertino, Calif., Symantec has operations in more than 40 countries.  More information is available at www.symantec.com.

An SSL certificate is a digital certificate that is used to verify the identity of a website and to encrypt information sent to and from the site. SSL certificates are issued by certificate authorities (CAs), which are organizations that have been Checked by a trusted third party (such as a web browser) to issue certificates.

When you visit a website that uses SSL, your browser will check to see if the site's certificate is valid. If it is, your browser will display a green padlock icon in the address bar to indicate that the site is secure. Additionally, the information sent between your browser and the website will be encrypted, making it more difficult for third parties to intercept and view.