We get a lot of targeted phishing emails to our employees, semi-sophisticated ones where they speak about a project or give an outline brief. We then get back to them and they send us an 'attached PDF', which is always a link to a phishing site requiring a Google or Dropbox password.
We're pretty good at spotting these a mile off, mainly because the fake Google or Dropbox site is crap using pixelated images / graphics, odd spelling etc. (Why they don't just go to Dropbox.com and copy the HTML source is beyond me, but that's their loss.) My fear is that we are getting more and more of these emails and eventually one of them will probably get past us. We also get a lot of spear phishing emails (where the spammer spoofs our domain in the sent field) but luckily we use Google Apps for business email which seems to have a 100% track record of filtering these straight to spam.
To combat it I've got the following in place :
- unique passwords for all sites, using 1password
- 2 factor auth for sites that allow it
- Avast anti-virus web extension that blocks some phishing / malware sites (but it doesn't always have every site listed; probably only about 25% of the sites I've come across it picks up)
Things I'm thinking of implementing :
- OpenDNS on office router (to create another layer of filtration similar to Avast above, as I believe OpenDNS has an automatic phishing / malware blacklist. Only downside with OpenDNS is it only would cover onsite employees unless it was manually installed as the primary DNS on each device.)
Is there anything else I should be looking at implementing to prevent these attacks ?