GUIDACENT THREATRECON ADVISORY

Defense
Guide

© 2021 Guidacent

phish⬧ing(noun)
1. the fraudulent practice of sending emails
purporting to be from reputable companies
in order to induce individuals to reveal
personal information, such as passwords
and credit card numbers.
2. type of social engineering where an
attacker sends a fraudulent message
designed to trick a human victim into
revealing sensitive information.
Phishing attacks, that threaten data breaches,
account compromise, and malware has become
something of an existential challenge for
organizations to manage. Remote operations as the
new norm for many workplaces have added
complexity to the growing problems associated with
Phishing.
Guidacent has prepared this guide to help you keep
the bad guys from getting their hooks into your
business.
Phishing
Defense
Guide
An effective tactic. That’s how the
FBI Cybercrime Division describes the
growing problem that has become
something of a pandemic for the
world of Online Business Operations.
Your Guidacent Phishing Defense Guide can
help you reduce the risk of compromise
from a potential phishing campaign.
Did you know that more than 90 percent of all
data breaches began as part of a Phishing
campaign?
With an average click-through rate of more than
80 percent, phishing emails are the most effective
methods used by cybercriminals.
We open links or attachments in one out of five
times, which means that a well-designed phishing
campaign that targets more than five employees
in a victim organization will be successful.
Phishing campaigns begin with an email designed
to resemble a legitimate point of contact, but the
ways in which the attack and penetration allows
the threat actor to enter, pivot and route through
the system vary, once the campaign is successful.
“Phishing Defense Guide” © 2021 Guidacent -1-
PHASE 1
AVOID GETTING HOOKED!
Keep everyone informed and on
the look-out for fake messages
If a phishing scammer gets the email
credentials of one person in your organization,
they’ll target anyone using that email pattern,
and based on public data—it’s not hard to do!
ANTI-PHISHING 101
1. Educate your staff & schedule regular “Fake
Phishing” training sessions.
2. Keep your systems updated and patched.
3. Make sure you have a strong SPAM filter in
place, which detects malware, etc.
4. Have a “Cybersecurity Playbook” prepared for
when something happens.
5. Implement a web filter to block malicious
websites (they work right out of the box!)
6. Require encryption for all remote access into
your operations.
Cybersecurity giant, Symantec, reports that one in
2,000 emails are phishing attacks, equating to be
approximately 135 million attacks every day!
One big mistake companies make that leaves
them vulnerable to phishing attacks is because they
don’t have the right tools in place, and they don’t
train their staff on what to do when a security
event—like a phishing campaign—hits their inbox.
A popular attack method is when a threat actor
acquires protected information through social
engineering, including information collected from
public sites, or through extended phishing efforts.
And with an 80-percent success rate, it’s not that
difficult!
A phishing campaign’s success is based on the
threat actor establishing a level of trust with the
target victim or group. Once that trust or sense of
familiarity has been established, that’s when the
trouble starts.
Here are the three most common phishing
penetration methods used by threat actors:
1. Imitating the sender address in an email to
appear as a recognized point of origin.
2. Embedding a link in an email that redirects you
to a website that requests sensitive data.
3. Installing hostile code (“Trojan”), through an
email attachment or ad.
If you are looking at a link with a URL that doesn’t
begin with “https,” avoid the temptation of
accessing the link.
And be sure to rotate your passwords for all online
accounts on a regular basis. The more complex
password structure you use, the less likely it will be
compromised—even in a phishing campaign.
You can also reduce the risk of compromise from a
phishing campaign by keeping your browsers up-to-
date. Many attacks take advantage of systems that
are not current or that have known flaws as a result
of gaps in their system patches.
“Phishing Defense Guide” © 2021 Guidacent -2-
PHASE 2
REVIEW & PREPARE
Don’t click on that link!
It’s a good idea to NOT click on a link in an
email or instant message, just because you
know the person where it originated. When
possible, use your search engine to access the
origination point (the host site where you are
downloading the attachment).
SECURITY AWARENESS IS ESSENTIAL!
1. Reinforce company policies regarding not
sharing or revealing user credentials.
2. Encourage the use of company-sanctioned
file-sharing programs, rather than via email
attachments.
3. Adobe Acrobat Reader and Microsoft Word
often contain unpatched vulnerabilities that
can be exploited.
4. Explain incident reporting procedures and
ensure that users feel comfortable
reporting security incidents.
5. Automatically enable firewall, advanced
malware protection, encryption, and data
loss prevention on all endpoints.
Five Questions to Consider… While we
know the malware problem continues to
burden every business type and throughout
all sectors, Consider the following issues
when evaluating your defense strategy:
1. Are we validating everything?
By design, and unlike other attacks, ransomware
often takes temporary residence on a computer
with “Authenticated” credentials, which avoid
detection before its encryption algorithm
completes its objective
2. Do we have the right tools
(and are we using them properly)?
Effectively segregating your network and
ensuring your endpoint protection controls are
properly deployed, will have a powerful impact
on defending the edge of your systems.
3. How do we decide who gets access?
Organizations can no longer trust a user because
they are an employee (or say they are) or based
on their password alone. Zero Trust is a concept
based on the impetus that trust is never presumed
until proper authentication has been verified.
4. Did we lock the front door?
Review all firewall configurations to confirm all
non-essential activities are blocked. Consider
subscribing to an OSINT reputation service to
automatically block access to known malicious
actors.
5. What didn’t we fix that needed fixing?
Patch Management: Vendors provide fixes to
known and exploitable vulnerabilities. Make it a
point to implement the fixes and be sure that all
systems and software are current with respect
to their patching and updates.
“Phishing Defense Guide” © 2021 Guidacent -3-
 PHASE 3
ASK THE EXPERTS!
Guidacent’s ThreatRecon Security
Professionals can help get you
in a safer posture to defend
against a phishing campaign
You CAN improve the overall threat defensive
posture of your business operations against
the potential compromise from a phishing
campaign!
4 Ways to Evaluate RISK
1. Is the Risk Timely?
2. Is the Risk Relevant to business operations?
3. Is the Risk Pervasive and capable of spreading?
4. Does this Risk pose an Urgent impact
to the business?
Ready to learn how Guidacent can help
your business establish a strong
Cybersecurity Defense?
Email us at
cybersecurity@Guidacent.com
to schedule a free consultation.
Managing Cyber Risk means looking at the most
likely situations that you will face in your day-to-day
business operations.
For many organizations, becoming truly resilient to
ransomware attacks requires more than incremental
improvements. It requires organizational change that
broadens the scope of involvement at the top of the
organization and instills focus on business risk, rather
than technology controls.
It requires the ability to focus investments on
mitigating likely outcomes, based on a review of
attacker motives and the ability to anticipate high-
impact scenarios.
The consulting teams at Guidacent view
cybersecurity and risk management as elements to
better enable businesses to build strong,
secure operating environments, which extends the
value of our digital infrastructure and economy.
If your organization would like to explore how to
evaluate and address risk and build on the integrity
of your critical assets, contact us at
cybersecurity@guidacent.com.
Guidacent can help you on the journey and keep you
out of dangerous traffic as you’re following your
business path.
“Phishing Defense Guide” © 2021 Guidacent -4-