Prevent email phishing attacks this summer with 3 defensive measures

With summer vacations taking employees out of the office, phishing attacks are on the rise. Here are three ways companies can stay prepared.

With summer now upon us, it seems that everyone is on vacation. Just take a quick look at the number of OOO (out of office) replies piling up in your inbox.

While the organization needs to adjust to conduct business as usual with 75% of the workforce in place, it is now even more prone to phishing attacks.

In the ever-evolving war between hackers and organizations, 3.4 billion phishing attacks are raining on us every day. Each attack is better than its previous one, and the art of deception is rapidly advancing. With summer vacations on the rise, so are the OOO replies, turning summer into Christmas time for the hackers. That is because OOO replies provide these bandits with information to generate targeted phishing attacks.

While employees truly wish to remain diligent and not miss emails while away, each OOO reply inadvertently provides information about the mailbox owner, such as dates, forwarding contacts, alternative emails, phone numbers, titles, and possibly even vacation location details. Such information is “hacker heaven,” as there are plenty of details to create advanced and personalized phishing attacks that may hit employees as soon as they return from vacation.

SEE: Cybercriminals’ phishing kits make credential theft easier than ever (TechRepublic)

For example, a phishing attack may look like:

Hi Joe,

Good to have you back from your vacation. Hope you enjoyed it.

Just wanted to remind you that you need to update your security information.

Click here to complete your process.

The SOC team

The above example is only one out of thousands which shows how a personalized email may easily drive employees, who haven’t been trained for a while on phishing attacks, to click on a link that will cause a significant data breach. With today’s average cost of attack rising to $14.8 million USD, rising from $3.8 million USD in 2015, it is suggested that organizations increase their security awareness, especially now during the summer time.

3 protective measures for the summer

The guidelines below assume that a security awareness program is already running. If employees are trained monthly to detect phishing attacks, this practice would prove itself once they come back from their vacation and sift through their inbox.

Provide employees with guidelines on what to write and what not to write in the OOO notification

Information shared in the OOO replies can increase the likelihood of personalized phishing attacks. Therefore, create policies and guidelines as to what an OOO reply should be.

While each organization conducts their own set of policies when it comes to cyber hygiene, it’s recommended that OOO replies should not include personalized forwarding emails, phone numbers or names. Rather, if it is necessary to use a forwarding email, consider using a dedicated mailbox address that may be deactivated shortly after. Do not state the reason for OOO or location of travels. Keep it short. Keep it safe.

Provide employees with summer guidelines for corporate device security

Employees traveling abroad, especially for a long vacation, may take their laptops or other corporate devices with them. Laptops may be stolen or forgotten in a random coffee shop, and even without that risk, working conditions that lack security hygiene expose employees more than usual to unprotected public Wi-Fi networks, with higher chances of getting malware installed.

SEE: Mobile device security policy (TechRepublic Premium)

We recommend providing employees, right before traveling, with your policies on laptop security, the use of public Wi-Fi and which systems can be accessed using public Wi-Fi, and how to check emails on non-personal devices.

Install anti-phishing software

To reduce the burden of phishing detection on employees, anti-phishing software can help. This software inspects the content of emails, websites and other ways to access data through the internet and then warns the user of a threat. This safety net can also block likely phishing emails before they reach a person’s inbox.

Why running phishing simulations every month is important

Running phishing simulations continuously, at least once a month, provides hands-on experience that is invaluable for learning and retaining good cyber habits.

Phishing simulations, especially those that are personalized, teach employees how to deal with phishing attacks through real-world practice, enabling greater retention. Such awareness training programs are most effective when they occur regularly and at greater frequency and focus on threats employees are most likely to face based on their job role, department or location.

Organizations training their employees before vacation season can rest assured that this knowledge will be retained throughout the summer.

When we face hackers, we should not forget that they are advancing every single day. Only consistent training of your employees is the remedy to keep your organization safe.

Omer Taran is the co-Founder and CTO of CybeReady. As co-founder, Omer serves as the company’s technologist-in-residence. His vision for CybeReady drives him to build out a product roadmap that serves a variety of enterprise customers by blending best practices in learning with innovation. He’s known for bringing ideas to life both quickly and precisely. Omer’s vast technical chops are only rivaled by his pun-making abilities.