You've been selected. Congratulations.
You're a winner.
You've got free money waiting for you.
Your account has been deactivated.
Click here to confirm your account.
You've got a package waiting for you.
All of these things are different forms of phishing attacks.
Some of them are about greed and some of them are tapping into fear, but they're all trying to social engineer you.
They're trying to get you to take an action through some sort of immediate motivation.
So we're going to talk about phishing and what's behind it and how you can defend against it.
So one of the first things we'll talk about with so is the social engineering aspect of it.
Social engineering. What does that mean? Well, it means that we are trying to get you to do something.
It's a con game. I tell you to do something. I give you a time, motivation or something like that.
The clock is ticking in order for you to take an action quickly. And what am I trying to get you to do
as a result of this social engineering? Well, I'm going to try to get you to click on a link that takes you to some fake website.
If I can get you there, then I can get you to type in your credentials, and then I can steal your account or I can steal corporate secrets.
Or I could get enough information about you in order to open up a credit card in your name.
Another type of attack that I might be trying to get you to do would be to infect your system.
If you click on this link or you click on this file and open it, it installs malware on your system. Then I'm able to see your credentials or I can take over your system.
But these are sort of the object of what the phishing attack is trying to get. Now, how about the different types of phishing attacks?
Well, in fact, we've got phishing attacks that are general in nature.
So they're sort of the general phishing attack, which is pretty indiscriminate.
I'm just going to send out, if I'm in a phisher, I'm going to send this out to anybody and see who responds.
Then there's a more specific type of phishing attack that we call spear phishing.
And in a spear phishing attack, a specially crafted message that would make sense to you. In fact, the more specific it is to you and your environment,
the more likely you are to click on it. It doesn't have the same widespread appeal, but sometimes it's more effective.
So, for instance, if I know that you bank any particular place, I'll send you the phishing email as if it came from that particular bank.
Now, if you send a spear phishing attack and it doesn't apply to certain of your audience, then they don't fall for it. If I know I don't have a bank account at that place,
I'm not going to click, presumably. But this can be very effective.
Another form of this would be that it comes from your employer and they know who you work for. They could even spoof who it's coming from
and say that it's coming from your boss and therefore you're likely to click on it. So this is an example of spear phishing.
Another variation on this is called whaling.
This is a special case of spear phishing, where I'm going after the big fish,
I'm going for the C-suite. I'm sending this to the CEO, the CFO, the COO, somebody really important with lots of information and lots of access.
So I'm going to put in lots of detail. It's going to be very specially crafted in order to make sure that it's effective.
There are other options here as well that phishers use. SEO poisoning is another example where I put up a fake website and then I do enough to trick the search engine
into believing that my site is real and that this should be listed higher on the search results and then people going and doing a search. So this is not driven by an email.
They go and do a search on a regular search engine and they see this in the top three and they click on it when they're trying to get to their bank
and they end up getting to my fake site. And then another form of this is called Smishing.
Smishing is basically the same part being SMS. So it's a phishing attack, whereas most of these these first two, actually the first three are coming in email.
This is coming in through a search engine and this is coming through an SMS message.
But it's all intended to do the same sorts of things that we've seen over here. Now, what should you do to protect against this?
Well, there's a number of things you could do. The most important thing you could do in all of this is stop and think. Think about if it's too good to be true.
If it sounds that way, it probably is. You probably didn't win free money. Your account may have been deactivated,
but there's probably a better way to find out than just clicking on that link.
What are some other things? Don't click. The instinct, because we see something immediate is to respond and click on that.
The old rule and you may have heard this is don't click on a link if you don't know where it came from. I'm going to suggest to you you never know where it came from,
or at least in most cases you don't, because sending email addresses can be spoofed.
I could send an email that looks like it came from your bank and you might not be able to tell the difference.
I could send it as if it came from your boss, and you might not be able to tell the difference. So don't rely on who you think it came from.
Rely on. Is this something that you feel you should open or not? Are you expecting this file? Are you expecting this link?
That's a much better rule, I think, to follow. Are there things you can do? Make sure your systems are patched.
That is, keep the software levels up to date. In a lot of cases, phishers were relying on vulnerabilities in the operating system or applications in order to infect your system.
You can also do the traditional things like antivirus or the newer stuff like endpoint detection and response in order to protect your endpoint, your client system from these,
some other things you can do is use an email security program, something that basically scrubs all the emails that come in to you
and looks for links to known phishing sites and other types of dangerous places. And then another thing you could consider is using a secure DNS.
A DNS is the domain name server. That's what turns a WWW.website.com into a numerical address that's actually needed to send it over the internet.
So if you use a security DNS, it may have a list already of known phishing sites, known malware sites, known hacker sites.
And if you click on that link when it goes off to get a resolution to turn that name into a number, into an IP address,
it will simply deny and will not return that to you because it knows that that's a dangerous place to go in the first place.
IBM, in fact, offers one of these it's free if you're interested in it called Quad 9. And it's just basically go into your browser or to your DNS settings
on your system and change the DNS to 9.9.9 and it will provide that kind of protection for you for free.
There are other similar services as well, if you'd like to take a look at those. The bottom line is phishing is a huge attack. A lot of people are falling for it.
And you see this happening all the time and you see so many phishing emails coming in because in fact, people are falling for it.
Don't be a victim. Thanks for watching. Please remember to like this video and subscribe to this channel so we can continue to bring you content that matters to you.