What is phishing
and how do you
prevent phishing
attacks?

One of the most persistent cyber security trends of the last few decades is phishing.  Attacks surged by 11% over the past year and now account for 36% of breaches, according to the Verizon 2021 Data Breach Investigations Report (DBIR).  It's time for action.

Phishing is basically a confidence trick. Attackers typically impersonate a trusted individual or organization to persuade users to hand over personal information or unwittingly download malware onto their machines. They do this typically through malicious links and attachments in email or social media messages, though some attackers seek this information over the phone. Although tactics have evolved over the years, the end goal is usually to obtain login data or personal and financial information, or to install ransomware, cryptojacking malware or other threats.

Phishing was the highest volume of reported cyber crime in 2020, according to the FBI. Although the vast majority of attacks are email-borne, attackers use many other methods, too. Here are a few of the most common:

• Social media: Users tend to be more trusting of messages sent by their friends on social sites—something phishers take advantage of by hijacking contacts' accounts to spread malicious URLs.  Last year, the Federal Trade Commission recorded surging volumes of incidents starting on social media.
• Spear phishing: These are typically more targeted than usual phishing emails. That means the sender has researched the victim to include specific personal details in their message, lending it greater legitimacy.
• CEO fraud: Phishing attacks targeting senior executives are known as "whaling." Here, the threat actor impersonates the executive in order to trick an employee into wiring money abroad or buying up and sending gift vouchers.
• Vishing: Voice phishing, as the name suggests, is when scammers call up their victims directly to persuade them into handing over personal and financial information. They may also trick them into believing they have malware on their computer, in what's known as a "tech support" scam.
• Smishing: Unsolicited text message links could end up installing malware on users' devices. Sender numbers may be spoofed to add legitimacy.

Just one misplaced click could lead to:

• Ransomware compromise: Phishing is a top three vector for ransomware today. Some organizations have lost millions following serious breaches.
• Data theft: The average global cost of a data breach today stands at over $4 million.
• Business email compromise (BEC), aka whaling: This cost organizations an estimated $1.8 billion in 2020, more than any other cyber crime, according to the FBI.