Email Threats Explained: What is Phishing?

Most people are somewhat familiar with prevalent and dangerous email threats like phishing and malware; however, the methods utilized in these attack variations and the most effective way to combat these threats can be complex and confusing. Guardian Digital wants to educate businesses about common and costly email attacks, helping them navigate the complicated threat landscape with the latest information and the email security language they need to know to keep their users secure. 

To accomplish this, we are beginning our first ever Guardian Digital blog series: Email Threats Explained. The purpose of this series is to provide readers with the knowledge that is necessary to make informed decisions regarding the security of their business email accounts. We are going to begin by covering one of the most notorious email threats: phishing. This week I will introduce the threat, explain why it is such a serious problem for all businesses, and suggest best practices that organizations should implement to mitigate risk. Over the next few weeks, I will dive deeper into this topic, focusing on highly targeted and complex attack schemes like spear phishing and whaling.

What is phishing?

Phishing is an attack variation in which cyber criminals send malicious emails designed to trick users into falling for a scam. The motive behind a phishing campaign is usually to get people to reveal financial information, credentials or other sensitive data. Phishing scams often utilize social engineering tactics: a collection of techniques that criminals use to manipulate psychology. These tactics encourage individuals to act without stopping and thinking things through.

Why is phishing so serious?

Phishing is extremely prevalent because it is cheap, easy and effective. For these reasons, phishing is currently the most commonly used attack vector on organizations, leading to 53% of all cyber security breaches. Phishing campaigns are virtually free to carry out, but can be extremely costly to their victims. Those who fall for phishing scams may end up with data loss, identity theft or malware infections. These implications can cost businesses large sums of money and ruin reputations.

How Can I Protect Myself from Phishing?

User education can help reduce the likelihood of a successful phishing attack; however, user behavior is not predictable. Thus, a threat-ready business email security gateway is imperative in protecting against phishing. Guardian Digital CEO Dave Wreski states, “Engaging in email security best practices is important, but this alone will not prevent a successful phishing attack. To effectively safeguard business email accounts, a fully integrated email security solution that delivers total end-to-end control is critical. EnGarde Email Security Gateway provides real-time protection against phishing and other advanced email threats while continuously adapting to a changing business and security environment.” 

In addition to investing in a comprehensive email security gateway, being familiar with common characteristics that phishing emails often share can help reduce your chances of taking the bait. Some best practices for identifying phishing emails include:

1. Verify shared links to ensure that they do not lead to fraudulent websites or malicious code.
2. Scan all attachments for viruses or dangerous code.
3. If an email looks suspicious in any way, make a phone call to the sender to confirm the legitimacy of the email.
4. Check for spelling and grammatical errors which can indicate that an email is not authentic. Also, keep an eye out for suspicious subject lines and signatures.
5. Think about each email you receive before clicking on links or downloading attachments. For example, ask yourself: Does an order confirmation email you’ve received correspond to a recent purchase you have made? Do the sender and recipient addresses make sense?

Other tips for preventing successful phishing attacks:

1. Invest in security awareness training to educate employees on how to identify spear phishing emails and how to proceed if they feel that they have received a malicious email.
2. Only click on embedded links that you know are legitimate and safe.
3. Create strong, complex passwords.
4. If you receive an email from a source you know but it seems suspicious, contact that source with a new email, rather than just hitting reply.

Guardian Digital EnGarde Email Security Gateway Key Benefits:

• Mitigates the risk associated with spear phishing and other advanced email threats
• End-to-end email encryption and secure delivery
• Protects employees against social engineering and impersonation attacks
• Neutralizes threats associated with malicious attachments and links
• Authenticates every email delivered using DMARC, DKIM and SPF
• State-of-the-art heuristic technologies recognize malicious code and accurately identify and block highly targeted spear phishing attempts
• Multi-layered open-source architecture
• Fully-managed solution that can be seamlessly implemented into your business’s existing infrastructure 
• Exceptional 24/7/365 customer support

Stay tuned for the next blog post in this series: Email Threats Explained: What is Spear Phishing?