4

We get a lot of targeted phishing emails to our employees, semi-sophisticated ones where they speak about a project or give an outline brief. We then get back to them and they send us an 'attached PDF', which is always a link to a phishing site requiring a Google or Dropbox password.

We're pretty good at spotting these a mile off, mainly because the fake Google or Dropbox site is crap using pixelated images / graphics, odd spelling etc. (Why they don't just go to Dropbox.com and copy the HTML source is beyond me, but that's their loss.) My fear is that we are getting more and more of these emails and eventually one of them will probably get past us. We also get a lot of spear phishing emails (where the spammer spoofs our domain in the sent field) but luckily we use Google Apps for business email which seems to have a 100% track record of filtering these straight to spam.

To combat it I've got the following in place :

  • unique passwords for all sites, using 1password
  • 2 factor auth for sites that allow it
  • Avast anti-virus web extension that blocks some phishing / malware sites (but it doesn't always have every site listed; probably only about 25% of the sites I've come across it picks up)

Things I'm thinking of implementing :

  • OpenDNS on office router (to create another layer of filtration similar to Avast above, as I believe OpenDNS has an automatic phishing / malware blacklist. Only downside with OpenDNS is it only would cover onsite employees unless it was manually installed as the primary DNS on each device.)

Is there anything else I should be looking at implementing to prevent these attacks ?

Improve this question
4
  • 1
    One of the best ways is to make people more aware of phishing and how to spot phishing. Some emails will definitely get through those filters. In that case, the last line is the human deciding not to open the attachment or clicking on the link.
    – Farhan.K
    Dec 12, 2016 at 14:04
  • Is password phising the only thing or are you worried about malware and other forms of malicious email? Do you have internal active directory?
    – billc.cn
    Dec 12, 2016 at 14:18
  • I don't use 1Password myself, but wouldn't it only fill in a password when the login form is served from the genuine site?
    – Andrew M.
    Dec 13, 2016 at 0:30
  • @AndrewM. correct thats exactly what it does do, but because when setting up a new web login you can use it to generate a unique password it means that its an easy way for all members of a team to remember multiple unique passwords for various accounts.
    – sam
    Dec 13, 2016 at 14:33

4 Answers 4

Reset to default
4

Big companies themselves send phishing mails to their employees on a regular basis in an semi-automated fashion. If an employee is trapped then he/she is informed like "what did you do? vs. what should you have done".

The problem is that the weakness phishing targets is not a technical weakness, it is a human non-technical weakness. So in my opinion you will only have limited success if you try to address this with a purely technical solution. I would try to invest as much as possible into awareness training and make sure employees stay aware through training, training, training.

The training can be backed up by a couple of simple very concrete rules like:

  • if someone calls you and asks for something that looks fishy, try to identify the caller through the enterprise phone directory and call him/her back
  • never hand out confidential information (like passwords) over phone, email
  • if network / phone support calls you surprisingly saying they need your support get in contact with phone number XYZ to confirm this is REALLY network / phone support (in this case you need to set up some service at number XYZ that is aware of all maintenance activites in your company)
  • TBC

Make sure every employee reads and understands this and have them sign off that they did.

My bottom line: Investments in organizational setup to prevent this from happening are probably at least as important as technical counter measures.

Improve this answer
1

Security middleware can really help here if you have the budget for it.

Tools such as Sophos' Unified Threat Management system or Microsoft's Threat Management Gateway (though I think that is pretty much dead now) provide continuously monitored protection against both known and emerging threats & can really help when a user has a brain failure (as we all do from time to time).

A third-party mail filtering service can also help. I use Mailroute on my personal/family email because I got a good deal on it some years ago.

A lot really depends on the risks to your organisation. Worth documenting both the risks and their corresponding impact (if the risk were realised) both in reputational damage and direct cost. That way you can then create a business case for spending an appropriate amount of money.

Improve this answer
0

At MTA level, implement SPF, DKIM signatures, and DMARC. Phishing campaigns to educate your users can be implemented through tools like phishme.com (commercial) or TrustedSec's SET (open-source).

Improve this answer
2
  • Most of the phising emails we receive are from gmail / outlook accounts claiming to be a client who wants to discuss a new project, and will include a PDF with the project details. Would implementing SPF, DKIM signatures, and DMARC help defending against senders using gmail / outlook accounts. Or would it only help if people where trying to spoof other email organisation ?
    – sam
    Jul 5, 2017 at 16:35
  • Is there any evidence that DKIM or email authentification in general actually accomplish anything?
    – curiousguy
    Jul 31, 2018 at 17:08
-1

Have you taken a look at DNS-based web filters, that might be a better solution for your needs - I have used WebTitan and I'm very happy with it. They do a good spam filter too.

Its good that you are only getting the easy to identify phishing emails, but I've seen some phishes that are almost impossible to detect. High quality, few spelling mistakes, good images etc. Spotting those can be tricky. Depending on how the level of risk you face, it might be worth conducting phishing simulation exercises. There are a few vendors out there. PhishMe are very good and have some great tools and training material. Its a paid service, but they do offer a great phishing simulator for small businesses that is free.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .