Phishing

Layer 8: People High risk

How it works

Phishing is the most common way attackers get a foothold in an organization. A message is crafted to look like it comes from a trusted source, such as Microsoft, a bank, a courier, the Canada Revenue Agency or a colleague. It creates a reason to act quickly: an expiring password, a missed delivery, an unpaid invoice or a shared document waiting for review.

The link typically leads to a convincing fake login page that captures whatever the person types, or the attachment installs malware when opened. Because these campaigns are cheap to send in huge volumes, attackers only need a small number of people to fall for them. A single captured password can open the door to email, files, banking portals and, eventually, the rest of the network.

Warning signs

• Urgent or threatening language pressuring you to act immediately
• Sender addresses that do not match the organization they claim to be
• Links whose real destination differs from the displayed text
• Unexpected attachments, especially zipped files or documents asking to enable content
• Requests to sign in again to view a shared file

How to defend against it

• Use advanced email filtering with link and attachment scanning
• Enforce phishing-resistant multi-factor authentication where possible
• Run regular security awareness training and simulated phishing
• Make reporting easy with a one-click report button
• Configure SPF, DKIM and DMARC on your domains
• Keep browsers and operating systems updated

If it happens to you

1. Report the message to IT right away, even if you only clicked
2. Change the affected password from a known-clean device
3. Have IT revoke active sessions and review sign-in activity
4. Scan the device for malware if an attachment was opened