How to Prevent Phishing in Your Organization

Phishing is a cybersecurity tactic that involves sending emails that appear to be from a legitimate source, such as a company or individual, and asking the recipient to provide their personal information.

Phishing can be dangerous because it can lead to the theft of personal information, such as passwords and account numbers, which none of us really wants.

But let’s look at phishing from an organizational point of view. It’s more lucrative for cybercriminals to attack an entire organization than it is for them to go after just one individual.

So the main question here is…How to prevent phishing in your organization?

The reality is that cybercrime is something we all have to deal with, as long there are computers connected to the internet.  It comes with the territory, and it sucks.

That’s the bad news.  But there is good news as well.

You can be proactive to prevent yourself and your organization from becoming a victim of phishing.  Let’s see what steps we can take to do just that.

3 Ways to Prevent Phishing

There are of course many ways to prevent yourself from becoming a victim of phishing.  But I wanted to give you three here that I thought were the most impactful.

Be a Proactive User

First, let’s start with you, the user.

Many of us browse aimlessly on the internet and get trigger-happy and click on links as they get sent to us.  It’s like we can’t help ourselves and simply have to click that “blue hyperlink” that turns our mouse into a pointing finger when we hover over it.

But instead of clicking that link without even thinking about it, let’s do some verification.

Most phishing attacks happen via email.  The scammer will send you something that looks legitimate and you think nothing of it and click on the link.  Two ways you can verify the legitimacy of that email and link.  The first is to check the URL of that link BEFORE clicking by hovering your mouse over that link and a pop up will come up to show the URL

If that first option is not working, the second way to verify is to try and open the home page of that URL in another tab or browser (I’d recommend doing so in an incognito or in-private window).

If you recognize the website or it comes up without an issue, you should be okay.  You might be asking, “well how would I know what the URL is if I’m not able to see it when I hover over the link with my mouse?”  That’s a great question.

Simply open Google and look up the company, institution, or entity that’s being mentioned in the email.  You will get results about that company and how to get to it.

So before you click on that link verify, verify, verify…

Install Antivirus Software

Security software has come a long way to be vigilant against phishing.  There are many antivirus application to choose from, as many of them has included anti-spam and anti-phishing as part of their offering.  So this can be an overwhelming decision to make if you’re someone who doesn’t know what to look for.

So to be helpful here, I’ll provide you with a few products that I’d recommend using to defend against phishing.  There are several options for you to choose from, but I’m going to provide you with  a few that I would recommend:

1. Bitdefender: Considered a global cybersecurity leader, Bitdefender provides solutions that prevent phishing in your organization. Phishing attacks can be very sophisticated and sometimes difficult to detect, but Bitdefender’s anti-phishing solution uses a combination of technologies including machine learning, email monitoring, and URL filtering to identify and block phishing emails.
2. Norton Antivirus: This antivirus has become a trusted household name, as it relates to cybersecurity.  Norton is one of the first names we think of when we think of virus protection and other forms of malware.  Well, they also do pretty well in the antiphishing area, and I would recommend them.
3. Avast: This is another antivirus that I would recommend.  Avast antivirus and antiphishing programs can definitely help protect your organization from malware and other online threats.  Avast also provides real-time protection against phishing attacks, which means it constantly monitors your online activity for any signs of a possible attack. In my opinion, another great option for preventing phishing attacks.

Use Network Firewall

Having a physical firewall placed on your network is also a great way to secure your organization from phishing in addition to other cyber threats.

One brand that I’m familiar with that does a really good job is the SonicWall firewall. It can be a critical part of your organization’s security infrastructure, as it can help prevent phishing attacks by identifying and blocking malicious emails before they reach your users.

Just make sure to configure your firewall properly, as it can sometimes cause other blockages on your network, that can be more of a hindrance than it is helpful.  So be sure to do some research on how to configure a firewall property, or ask your local tech person to configure one for you.

What To Do if You’re a Victim of Phishing?

I always like to lead with prevention is better than cure.  But we all know that cannot always be the case because life happens.  So here are some effective methods you can use to recover in the event you or your organization becomes a victim of phishing of any kind.

Change your Login Credentials

Whatever the account is that the hacker was pretending to be, go in and change the login information to that account as fast as possible.  It is said that 86% of passwords online are terrible and can easily be guessed, so be sure to change it to something that would be difficult for others to figure out.

I would probably even go a step further and contact the support team of that company and inform them that your account might have been compromised.

From there, follow whatever procedures they have in place to either prevent the account from getting accessed by an unauthorized person or salvage whatever damages they can.

Backup Your Account

Depending on the account that’s compromised, if there’s any data associated with that account that you feel is very important, if you weren’t already, figure out how you can backup that account.  Backing up your data should always be a number one priority for any organization, so this one should not come as a surprise.

Virus and Malware Scan

This may not be the first thing that comes to mind, but doing a virus scan with the installed antivirus (you shouldn’t even be connected to the internet without an antivirus) and malware could play a major role in helping your recover from a possible attack. 

I’ve already mentioned the antivirus programs that do a good job to protect against phishing.  But installing another 3rd party application to do another type of scan could potentially find something your other antivirus program was not able to discover.

In this case, I’d recommend Malwarebytes.  They do a pretty awesome job with antiphishing as well. 

Common Examples of Phishing Emails

Here are some common examples of phishing emails:

1. Emails that appear to be from your bank or other financial institution, asking you to confirm your account details or update your password.
2. Emails that ask you to click on a link in order to download a document or view a video. The link may lead to a fake website that looks very similar to the real one.
3. Emails with attachments that claim to be invoices, receipts, or other important documents. However, the attachments may contain malware that can infect your computer with something else.

Phishing emails are becoming more and more common, and hackers are becoming smarter and more sophisticated. While there is no one foolproof way to prevent phishing in your organization, following some of the tips given here will definitely reduce your chances of becoming a victim.

Final Thoughts

So figuring out how to prevent phishing in your organization does require a more proactive approach to stay ahead of attackers. Phishing is a growing concern for both individuals and businesses alike and can be relatively scary, as it can lead to identity theft among other crises for your organization.

As I’ve eluded to earlier, there is no real way that will guarantee 100 percent safeguard against phishing.  However, in addition to what I’ve laid out here, here are some proactive measures for you and your organization.

• Educate your users on how to identify phishing emails, and remind them to never click on any links or open any attachments in suspicious emails.
• Install a spam filter to help catch malicious emails before they reach your users.
• Use strong passwords and two-factor authentication if possible, to help protect your accounts from being compromised.
• Keep your software up to date, and install patches as soon as they become available.
• Monitor your network for signs of unusual activity, and investigate any suspicious activity immediately.
• Never open emails from unknown senders.
• Be suspicious of emails that request sensitive information, especially if the email doesn’t seem to be addressed to you personally.
• Don’t click on any links or download any attachments in suspicious emails.
• If you’re not sure whether an email is legitimate, contact the sender directly to ask about the message.

As you can see, there are many ways to prevent phishing in your organization. And I believe educating your employees on the dangers of phishing and how to identify a scam email is the first step. Using additional software and hardware like a firewall can also be the next step.

Combining these methods for sure would put you in a much better situation to prevent a phishing attack.