Table of Contents
1. What is Phishing?
Phishing is a cyber attack method in which attackers pose as a trusted entity in order to steal sensitive information such as passwords, credit card details or login credentials.
Alarming statistics
91% of all cyber attacks start with phishing
1 in 99 emails is a phishing attack
30% of phishing emails are opened
12% click on malicious links
2. Types of Phishing Attacks
Email Phishing
Classic phishing via forged emails that pretend to come from banks, online shops or government agencies.
Warning signs
- • Urgency and time pressure
- • Spelling and grammar mistakes
- • Suspicious sender addresses
- • Requests to enter data
- • Unexpected attachments
Spear Phishing
Targeted attacks on specific people or organisations using personalised information.
What makes it different
- • Personalised approach
- • Researched information
- • Higher success rate
- • Professional presentation
- • Often aimed at executives
CEO Fraud / Whaling
Attacks that impersonate senior management in order to trick employees into making fraudulent transfers.
Typical sequence
- • Email from the “CEO” to accounts payable
- • Urgent transfer demanded
- • Confidentiality emphasised
- • High loss amounts
- • Time pressure used as leverage
Smishing & Vishing
Phishing by text message (smishing) or telephone (vishing) instead of email.
Examples
- • Parcel notifications by text message
- • Calls from “Microsoft Support”
- • Bank security warnings
- • Prize notifications
- • Verification requests
3. Recognising Phishing Emails
Warning signs
- Check the sender: suspicious email addresses (@gmial.com instead of @gmail.com)
- Check the links: hovering over a link shows the real URL
- Urgency: “act immediately” or “account blocked”
- Attachments: unexpected .exe, .zip or Office files
- Language: faulty grammar or unusual phrasing
Responding the right way
- ✓Do not click: never open links or attachments
- ✓Tell IT: forward suspicious emails to your IT department
- ✓Verify: if you are unsure, check back by phone
- ✓Report: use the phishing button in your email client
- ✓Delete: remove suspicious emails immediately
4. Technical Safeguards
Email Security Gateway
Professional email security solutions filter phishing emails automatically.
- • Kaspersky Security for Mail Server
- • ESET Mail Security
- • Bitdefender Email Security
- • Spam and malware filters
- • URL rewriting & sandboxing
SPF, DKIM & DMARC
Email authentication prevents domain spoofing.
- • SPF: Sender Policy Framework
- • DKIM: DomainKeys Identified Mail
- • DMARC: Domain-based Message Authentication
- • Protection against forged senders
- • Improved email deliverability
Browser Protection
Browser extensions and endpoint protection warn about phishing sites.
- • Anti-phishing browser extensions
- • Safe Browsing technology
- • URL reputation checks
- • Real-time warnings
- • Integrated into endpoint security
5. Employee Training
The best technical solution is of no use if employees are not trained. Regular security awareness training is essential.
Training content
- • Types of phishing and how to spot them
- • Practical examples of real attacks
- • How to react when you suspect something
- • Reporting processes in the company
- • Regular refreshers
Phishing simulations
- • Monthly simulated phishing emails
- • Tracking of click rates
- • Immediate feedback on clicking
- • Micro-learning after a wrong click
- • Continuous improvement you can measure
6. What to do after a Successful Phishing Attack
Immediate actions
- Inform the IT department - report it without delay
- Change passwords - all affected accounts
- Isolate the device - disconnect it from the network
- Lock accounts - compromised access
- Document the incident - for the analysis
Follow-up
- •Forensic analysis: determine the scope of the attack
- •Inform affected parties: check GDPR reporting obligations
- •Lessons learned: improve your processes
- •Adapt training: feed the findings back in
Protect your business from phishing
Put comprehensive phishing protection in place with technical solutions and regular employee training.