How do you protect against phishing attacks?

Phishing attempts are so common now that you’d be hard pressed to find an internet user who hasn’t seen one. According to the government’s cyber breaches survey, 86% of businesses experienced a phishing attack in 2020, a rise of 14% since 2017.

This growth has only sped up since the start of the pandemic. HMRC detected a 73% rise in email phishing attacks in the six months since the pandemic began. As far as security researchers can tell, this sudden increase can be linked to the rise of home working and the vulnerable emotional state many targets find themselves in. Criminals have seized the rapid change Covid-19 has brought and will continue to do so until the global cases recede.

Find out how FE college, Coleg Gwent, is protecting its users from phishing attacks in this case study >

Despite this increase, when most of us think of phishing attacks it’s the ones that are easy to spot. Such emails poorly imitate a company in a bid to get you to divulge account or payment information. As you may have noticed, though, phishing attempts are getting more sophisticated.

“Spearphishing” attacks take a step back from the broad net attackers usually cast and highly tailor emails or phone calls to target specific employees. Often, once they have access to a network via a low-level employee, they impersonate them, targeting those with more valuable information.

These types of emails can be difficult for experts to spot, let alone your average user. As a result, preventing successful attacks can be a real challenge for many IT departments. Though some basic training will prevent the bulk of phishing attacks, it does little to prevent high-level imitations.

How to reduce the success rate of phishing attacks

If basic training isn’t enough, what can you do to protect your business against this new wave of attacks? Here are some of our top suggestions:

1. Strengthen domain security

With impersonation attacks so common, it’s vital that enterprises have strong domain security. If an attacker manages to get a hold of your registrar account, it becomes infinitely easier for them to pretend to be someone in your organisation. With the right access, they can send an email from a company address and mastermind attacks that are far more successful.

As well as securing your registrar account, you may want to register the most common misspellings of your domain and implement security protocols like DMARC and SPF and DKIM.

2. Reduce available information

Holding detailed information about your company on its website may provide reassuring transparency, but it’s also a treasure trove for attackers. Think about what information your customers need to know and what is just unnecessary fuel for attackers. Is it really important that your customers know who every team member in your company is? Does each of them require a publicly accessible email address, or can inquiries be directed elsewhere?

This extends to the information your employees share on social media. Attackers can use information about recently closed deals, new partners, and more. Ensure you have a clear and strict policy about what information should be made public.

3. Adopt a culture of caution

Though many companies perform training sessions, staggering numbers of employees click on phishing links every day. For the biggest impact, resilience shouldn’t just be boiled down to a quarterly seminar – it needs to be built into the culture of the company.

Adopting a “caution over comfort” mindset will help employees to think critically whenever they see an email that makes them uneasy. Make it known that they’re encouraged to double-check with their superiors or the IT department if they have any doubt.

This should extend to transactions. Often, phishers who have access to credentials will strike by jumping into an existing email chain about a deal and providing their own payment details instead of the intended recipient. A strict transaction policy that requires validation through security questions on a different communications channel can combat this.

4. Run spoof phishing campaigns to raise security awareness

Regularly running imitation phishing campaigns raises awareness amongst your user community about what to look for in a genuine phishing attack, and helps you identify individuals who need further support.

To help you run regular campaigns, we provide Phishing & Security Awareness as a Service. This hands free service means you don’t have to remember to run phishing campaigns, we do it for you. Campaigns are regularly updated in line with the evolving sophistication of genuine attacks. For many of our customers, this service helps them to tick compliance boxes and cyber security training requirements.

Find out more here >

5. Stop phishing emails in their track a robust email gateway

Implementing the above tips will significantly reduce the chance that a phishing attack is successful without a significant financial investment. However, the unfortunate truth is that so long as phishing emails are still hitting employees’ inboxes, mistakes will be made.

That’s where an email gateway like Mimecast or Fortimail comes in. By scanning email in real-time, these solutions identify suspicious emails and block, flag, or categorise them before they reach an employee’s inbox. They scan every URL, sandbox and scan all attachments, and look for anomalies in the sender and email text.

With an intuitive dashboard and regular updates, email gateway solutions act as a one-stop-shop for phishing protection, taking human error out of the equation while reducing the burden on the IT department.

If your organisation is experiencing an increase in phishing attacks and you’d like help protecting your users, data and systems, please get in touch. We’re always happy to discuss your unique environment and the options available.

Ransomware attacks are not a new security threat. In fact, the first was orchestrated in 1989, with its proceeds allegedly going to charity. In the past five years, however, ransomware attacks have the hit headlines across the globe. Attacks, experts say, are becoming more sophisticated, more harmful, and more frequent.

In its base form, ransomware is a type of malware designed to lock a user out of their files – typically by encrypting them with a key only the attacker knows. The methods to achieve this, however, are constantly evolving.

The notorious WannaCry ransomware is perhaps the most successful example of this. It made use of an exploit discovered by the United States’ NSA to achieve an unprecedented level of spread. It successfully hit the NHS, FedEx, and more, expanding through their network automatically to lock as many computers as possible.

Get a free cyber security health check, to get a clearer idea of your organisation’s vulnerabilities and how to manage threats like ransomware. Click here to book >

Since the success of WannaCry, there has been an explosion in the number of ransomwares, some of them using similar techniques and others creating new ones. The highly-sophisticated Ryuk has had particular success in recent times, combining a credential theft trojan with manual intervention to strike swiftly across the entire network.

According to a recent SonicWall study, the number of new ransomware variants is only growing. It noted a 46% increase in new strains each year, with Ryuk accounting for a third of all attacks.

So, how high is the threat to UK businesses right now? A report by Check Point suggests higher than ever. Ransomware attacks in the UK jumped by 80% in Q3 2020 as attackers looked to exploit mass remote working. Worldwide, it says, a new organisation becomes the victim of ransomware every ten seconds.

Further, the number of so-called “double-extortion” ransomware attacks are increasing. Attackers are not only threatening to lock enterprises out of their data – they also say they’ll leak it if they don’t pay up. Nearly half of all attacks used this method in Q3 2020, making it a significant and developing risk.

Protection against ransomware attacks

With this increased threat, businesses stand to lose even more should they fall victim to a ransomware attack. As well as the weeks of downtime ransomware can bring, improper protection can lead to leaks of confidential documents and intellectual property.

Fortunately, while attacks are becoming more sophisticated, so are the cyber security solutions deployed to protect businesses from these threats. Combining sophisticated backup systems and advanced anti-malware protection, many solutions use heuristic analysis to detect known and new ransomware and stop it in its tracks. By constantly monitoring machines, these solutions will suspend a ransomware’s activities and restore a version of the file from moments before.

Further safeguards are also needed to protect local and cloud backup files. Solutions that actively monitor local files, prevent backups from being modified. When choosing cyber security backup solutions, look for products that feature strong end-to-end encryption and only allow modification by authorised agent software. This ensures that protection applies even if the ransomware tries to overwrite the Master Boot Record (MBR) or tries to attack the security software itself.

What solutions are right for your organisation?

Every company and organisation is different, with different vulnerabilities, risk profiles, IT environment and, of course, available budget. For this reason, not every security solution is right for your organisation, which is why we recommend an initial cyber security health check to help understand your requirements and environment before looking at potential solutions. If you’d like to take us up on our free offer, please click on the link below.

The cyber threat to the Further and Higher Education sector sits within the wider threat to UK enterprise overall. As with any large organisation, universities and colleges handle large volumes of personal data, intellectual property and other data assets, all of which makes education a target for cyber attack.

Understanding what assets you hold and why they may be of value to cyber criminals and malicious actors is a key step towards protecting your organisation, your data and your people. Below we explore what’s special about education and who may be targeting your organisation.

Read our case study exploring how we deployed a comprehensive email solution for further education college, Coleg Gwent here >

Why are universities vulnerable to cyber attack?

Large volumes of data

Further and Higher Education institutions handle large volumes of sensitive data that may be held for many years. A wide variety of data on students, faculty members, alumni, parents and university staff make them highly attractive targets.

Research universities and medical schools may also handle data from other organisations. Such as medical data for hospitals linked to the university or corporations and public sector bodies connected to research projects and grants. This data may attract both those seeking financial gain as well as those looking to steal intellectual property.

Lack of centralised structure

In many cases, sensitive data is stored in different locations rather than one centralised place. Student data may be stored by individual colleges or campuses. With many education providers merging to form larger establishments, staff data may also historically reside in different locations.

Furthermore, duplicate sensitive data may be propagated across an organisation, with different departments holding the same information. Alumni offices, central administration, schools and colleges may all have their reasons for storing the same data on a student or even faculty staff.

Organisational vulnerabilities

Decentralisation is often reflected in other ways too. Such as cyber security policies, processes used to handle data, cyber security tools and security awareness programmes.

Ensuring that everyone within such a diverse organisation adheres to the same policies and safeguarding procedures is no easy task.

Widespread use of personal devices

FE & HE institutions depend on large sectors of their user community having a personal device. Students are the obvious risk, with the majority accessing organisational systems from often less well protected mobiles, tablets and laptops.

However, admin and faculty staff also use their own devices, especially in recent times with the increase in remote learning / teaching. Security awareness can be a problem and there can also be resistance from the user community if the IT department want to put controls in place on personal devices.

Remote learning

Accessing organisational apps and data remotely exposes another vulnerability. This can be exasperated by lack of data security awareness, frustrations around using new technology to work or teach remotely and a proprietary attitude to personal devices.

Who’s attacking your network?

So who’s responsible for this increase in attacks on the education sector? The key threats to education establishments are:

1. Criminals looking for financial gain
2. State-sponsored espionage

Both actors will use the same vulnerabilities to access your network. But while the criminal looking for financial gain will often make themselves known once they’re ready to act with a ransom demand, nation states seeking to steal personal data and intellectual property and criminals stealing data to sell, prefer to remain undetected.

Ransomware attacks on the increase

Since late February 2021, the National Cyber Security Centre (NCSC) has seen an increased number of ransomware attacks affecting education establishments in the UK. The NCSC previously acknowledged an increase in ransomware attacks on the UK education sector during August and September 2020. It has now updated its Alert in line with the latest activity.

Ransomware attacks prevent organisations from accessing their systems or data until a ransom is paid. Threats to release stolen sensitive data on ‘name and shame’ websites, are also on the increase if the ransom is not paid.

The NCSC said that, “In recent incidents affecting the education sector, ransomware has led to the loss of student coursework, school financial records, as well as data relating to COVID-19 testing.”

Attackers gain access to the target’s network depending on the vulnerabilities they identify. Common attack vectors include:

1. Phishing
2. Remote access systems: remote desktop protocol (RDP) and virtual private networks (VPN)
3. Unpatched and unsecure devices

Once inside your network the attacker will generally increase their privileges in order to identity high-value assets. The NCSC reports recent malicious activities including:

• sabotage backup or auditing devices to make recovery more difficult,
• encrypt entire virtual servers,
• use scripting environments (e.g. PowerShell) to easily deploy tooling or ransomware.

How to protect your users from ransomware attacks

The best defence is to your people. Security awareness training (regularly updated) and imitation phishing campaigns to raise awareness and also identify susceptible users, makes a real difference. This can be challenging with a high turnover of students, which is why comprehensive security measures must also be deployed.

Relatively simple measures can be put in place to secure your network. A robust approach to patching will help secure devices. Multi Factor Authentication (MFA) provides an additional level of security for remote access systems. Vulnerability Management identifies vulnerabilities, balances risks with business operations, and gives you much needed visibility to protect your establishment from evolving threats.

Email security platforms are vital to identify and disrupt phishing attacks. These solutions don’t have to be onerous on the IT department either. End-user quarantine management processes protect your network but allows users to self-service and release their own messages in a secure environment.

If you would like to discuss how to better protect your network and data, please get in touch with our cyber security team. We work with many schools, colleges and universities, and are happy to share experience and best practice.

To read our case study on Coleg Gwent’s email security solution, click here >