When we were children, many of us learned from our families
or teachers not to talk to strangers. Yet somehow, in the virtual world of the
Internet, people seem to have forgotten this essential security lesson and
willingly participate in information exchanges via email with
"strangers." This puts your customers, your data, and your organization
in general at risk.
It seems that every day a new type of phishing attack or
malicious spam attack is making headlines. More recently, a new form of malware
called German Wiper has primarily targeted German companies. Like most
malicious programs, it messes with victims' files and demands payment for their
safe return. However, instead of encrypting data like traditional ransomware,
this non-traditional form of ransomware rewrites a user's files into zeros and
ones, ultimately destroying the data.
So how can you help your business avoid being the next
victim of a data breach due to phishing, malware, and other predatory tactics?
Following the security practices for the use of your email.
1.
Create a comprehensive cyber security plan that has email
Having a developed and comprehensive cyber security plan
can help your business avoid or be prepared to face many of the threats lurking
online. No matter how big or small your organization is, if you don't have a
cybersecurity plan yet, you should get one now.
Your cybersecurity strategy should include guidelines,
policies, recommendations, and requirements regarding the implementation and
use of technology. This includes email communications.
2.
Regularly conduct cyber awareness training for your employees
Cybersecurity awareness training is vital for every
employee at every level in every organization. It doesn't matter if you are a
multi-national company or a small family business, whether you work as a CEO, a
middle manager or a personal assistant, you are still a potential target for
cybercriminals. This means that you must be able to react appropriately to
email-based threats.
When one of your employees receives a phishing email with
some kind of attachment, there are two main ways to respond:
The end user interacts with the attachment, allowing their
computer or device to become infected with malware, which can lead to a breach
of your network or even a ransomware attack.
They choose to mark the email as junk or spam, perhaps even
taking a moment to send an email to your company's IT team to let them know
what just happened.
As the example above shows, effective computer security training
can help your employees learn to safely identify and handle spam and phishing
emails. This includes training them to properly flag spam and other malicious
emails. However, it is essential to emphasize that this training is not a
one-size-fits-all solution. It is something that has to happen continually
because email scam tactics have evolved. In fact, some phishing emails are so
compelling that they can fool even seasoned IT security experts.
The decision to implement the training is up to you: some
companies prefer to offer self-training materials online or in print, others
prefer face-to-face or an integration of the two methods. Do what works best
for your company and your employees. Just be sure to continue to do so and to
regularly test your employees with phishing simulations.
Cybersecurity awareness is like a muscle - the more you
work it and keep it engaged, the stronger you get. If you become complacent,
you will see your employees' sense of cyber awareness "warp" and
become ineffective, leaving your organization defenseless against email-based
cyber threats. I'd say no one wants that, but you'd be lying - cybercriminals
expect exactly that.
3.
Invest in quality antivirus
Many antivirus
programs come equipped with many features such as mail filters, file scanning
capabilities, etc. If so, put these capabilities to work now. These tools can
help you identify some forms of malware and other threats by preventing your
devices or network from being infected.
Take the time to familiarize yourself with all the
functions of your antivirus program. This way, you are not paying for a system
and you end up leaving some of its benefits unused. Also be sure to include
information about the antivirus program as part of your employee cyber
training. After all, what good is having a solid antivirus program if your
employees are just going to ignore it?
4.
Create email blacklists and whitelists
If you still don't maintain a current list of banned email
addresses (a blacklist), what are you waiting for? This list helps prevent
known spammers or cyber threats from reaching your inbox.
Almost as important is what is known as a whitelist, or the
list of email addresses that are allowed through your filters and server. This list
can also be maintained through those same three components (domain, email
address, and IP address / range).
5. Use
strong, hard-to-guess passwords
Cyber-attacks often involve credential compromise because
it provides the greatest access for the attacker.
A strong password is one that:
Includes a mixture of uppercase and lowercase letters,
numbers, and symbols.
Avoid using words which will be found within the
dictionary.
It does not include the names of your pets, family members,
favorite teams, or other information that you can easily find on your social
media profiles.
Password guessing tools can send hundreds or even thousands
of words per minute in brute force attacks.
6. Use
the S / MIME protocol for encoding and email signing
What if there was a way to prove your identity to your
email recipients while helping to protect the integrity of your data? That's
the job of S / MIME, or the "Multipurpose / Secure Internet Mail
Extensions Protocol (S / MIME)", an email security best practice.
This term refers to an email signature protocol that
increases email security by:
Create a time-stamped digital signature to confirm the
identity of the sender to the recipient;
Encrypt and decrypt the content of emails to provide
protection of data at rest and in transit; and
Facilitate the secure exchange of documents over networks.
Comments
Post a Comment