Phishing Training

How to Fight Phishing What is Phishing? Phishing is a cybercrime in which a target or targets are contacted by email, telephone or text message by someone posing as a legitimate person or institution to lure individuals into providing sensitive data such as personally identifiable information, banking and credit card details, and passwords. The information is then used to access important accounts and can result in identity theft and financial loss –www.phishing.org • • • • • Phishing is one of the easiest forms of cyber attack for a criminal to carry out and one of the most widespread In an email attack, the intruder gains access to everything in your mailbox and may forward emails to a different mailbox, or may delete email entirely Access to your email account may be then used to phish other people (YIKES!) By giving up your passwords and/or sensitive information you can expose university applications and data, and your personal, banking and social media accounts, as well A successful phishing attack can impact both your work & personal life What is Spear-Phishing? Spear-phishing is a targeted & detailed attempt to steal information such as account credentials, sensitive data or financial information from a specific victim for malicious reasons. This requires the attacker to research their target to find important personal details. The attackers then disguise themselves as a trustworthy friend or entity to acquire the information, typically through email or other online messaging. Spear-phishing can easily be confused with phishing because they are both online attacks on users that aim to acquire confidential information • Phishing attacks target a large number of people banking on the chances that someone will click on that link and provide their personal information or download malware. Unlike spear-phishing attacks, phishing attacks are not personalized to their victims & are usually sent to masses of people at the same time. Phishing refers to the “wide net” cast in order to hook as many as possible • Spear-phishing attacks target a specific victim and messages are modified to specifically address that victim, purportedly coming from an entity that they are familiar with and containing specific, personal information. They require more thought and time to achieve than phishing. Because of this, it is more difficult to identify spear-phishing attacks than to identify phishing attacks. Enterprises & organizations are especially susceptible to spear phishing attacks, as so much of their company data is usually freely available online. Why should I care about Phishing? The numbers don’t lie. Phishing is a huge “industry” and organizations like ours are a target. Compromised accounts are the number one threat to our cybersecurity. With a third of major data losses starting as phishing attacks, phishing is an issue we have to be informed, engaged and proactive about in order to protect university assets as well as our personal information. $1.7 B Amount lost in US to business email compromises in 2019 according to the Internet Crime Complaint Center (FBI) 32% Percentage of major data loss incidents that started with a phishing attack according to Verizon Data Breach Report 68,000 Average number of active phishing sites on the Internet in 2019 according to the Anti Phishing Working Group (APWG) Protecting University Assets Despite increasingly secure technology safeguards, when sophisticated email phishing methods and human error intersect, we risk compromising accounts and unintentionally exposing university data. Think of all the information you have online and multiply it by Boston University statistics: over 4000 faculty members, 14,000 employees and 34,000 students. That’s a whole lot of data we need to protect and we haven’t even covered labs, research, and grant data. We have a huge responsibility as part of the BU community. At Boston University we need you to take an active role in our community’s cybersecurity. This training is a powerful tool in being proactive about cybersecurity. The following lessons will walk you through identifying the warning signs you may have received a phish. After you’ve learned about the warning signs, we’ll put your knowledge to the test with our Phishing Quiz! In addition, we’ll give you the steps to take if you’ve received a phish or clicked on a phish. Let’s go phishing! Warning Sign: Personal Information PHISHY: The email appears to be from a bank and is asking for personal information in order to process a payment Be wary of requests for your information. A legitimate organization will never ask you for your password or other personal information • • • • Never reply to an email with your password Never reply to an email with your personal information before verifying the source and if the request is appropriate. Never enter information such as username and password in a pop-up screen Boston University, or any legitimate organization, will never ask you for your password! TIP: Your information is your information. Never hesitate to question why your information is being requested or the validity of such a request Warning Sign: Grammar PHISHY: “You’re account compromised” and the spelling of “imediatly” are examples of poor grammar and a phishing indicator! Awkward wording or misspelling within an email from a reputable source, or even a colleague or friend, is often time an indicator you may have received a phishing email • Be on the look out for spelling and grammatical errors as well as awkwardly worded sentences • Be on the look out for misspelling not only in the body of an email but check the subject and sender information too! • Be on the lookout for misspelling of a website or landing page within the email (more to come on hyperlinks!) TIP: Why would cyber criminals use poor grammar? Many scams originate from countries where English isn’t a primary language OR spelling and grammar errors make it a little bit easier for these messages to bypass "spam" filters Warning Sign: Urgency PHISHY: Notice the request for immediate action and the sense of urgency Cyber criminals want you to take action without thinking. Therefore they create a sense of urgency and call to action when crafting their scams: • • Important, urgent and action required are all red flags words and phrases If you’ve received an email requesting an update or to “reply immediately” the best action to take is to STOP and think TIP: Scare tactics are also used alongside urgency to create a sense of panic for victims. For example “your account will be deactivated within 24 hours if you do not reply” or “your data will be lost if you do not login” Warning Sign: Hyperlinks PHISHY: the hyperlink looks and reads like ‘paypal.com’ but when you hover over it the actual hyperlink displays Never click on links within an email before confirming they go where they “say” they’re going and that the link is a legitimate website • • Hover over links with your mouse to confirm the actual URL. Confirm it is a legitimate web address. If you don’t recognize it don’t click on it! If you are on a smartphone, click and hold the link and a box will appear showing you the real destination. Again confirm it is legitimate, you recognize it and you want to go there TIP: If you do click on a link that leads to a website about which you are unsure, don’t share personal information or download anything. Leave the website and run a security scan with your antivirus program Warning Sign: Attachments PHISHY: Before downloading any attachments ask yourself who is sending this and why are they sending it? Attachments may contain viruses, malware or ransomware (bad stuff!) Seemingly trustworthy attachments cause infections and permanent file loss. Verify before clicking and ask: • • • Was I expecting the attached file? Who is sending the attachment? What is it and why is this being sent to me? TIP: Verify ANY attachments you receive before opening them. Check the sender information is correct and known to you or reach out directly to the person or organization sending the email Warning Sign: Timeliness PHISHY: You weren’t expecting a package but just received a notification from a delivery service Timing is everything. If an email seems untimely and out of context, stop and think. Ask yourself: • • • Was I expecting an email from this person or organization around this time? Is this email being sent for a request I did not initiate? Why am I receiving this email right now? TIP: Verify directly with the sender or visit their website before clicking on anything or responding to an untimely email. Identify & Avoid Spear-Phishing & Phishing • • • • Be mindful of personal information you post on the internet: Look at your online profiles. How much personal information is available for potential attackers to view and use? Use smart passwords practices: Reusing passwords means that if an attacker has access to one of your passwords, they have access to all of your accounts that use the same password. Think “Unique account, unique password”–especially for your most important online accounts like your Kerberos, personal email and banking accounts. Consider using a password manager Keep software & applications up to date: Enable automatic software updates or if your software or an application notifies you that there is a new update, do it right away. The majority include security software updates that should help to protect you from common attacks. Use logic when opening emails: If an email seems “phishy” or out on context, stop and think. Remember, trustworthy organizations will never ask for your username or password. Reach out directly by phone or visit the website to verify the email. And remember, there are other “phish” in the sea... Email remains the primary method for phishers but be aware of other commonly used phishing methods: • • • • Vishing: Phishing technique where scammers attempt to contact you and gain information via a phone call Smishing: Phishing technique delivered through SMS text messaging Social Media Phishing: Phishing technique that uses social media platforms to hook victims Whaling: Detailed and targeted phishing attacks on senior executives TIP: Be on the lookout for the same warning signs in these methods that you’d find in phishing emails