Cyber Defense eMagazine November Edition for 2021

Stop Phishing in its Tracks
The Delta variant COVID-19 surge prompted cybercriminals to develop fake “vaccination requirement”
emails. These phishing schemes were sent to millions of workers, with official looking forms and links
asking for recipients to confirm their vaccination status while providing valuable personal information. It
is a common tactic for phishing schemes to prey on people’s fear and uncertainty along with a message
of urgency and possible consequences.
Hackers enjoy phishing schemes because they are easy to deploy and can provide fast access into
networks. The recipient clicks a link or opens an email or an attachment, and that launches malware
which can infect a computer and give the hacker administrative control. And, once they have control, they
encrypt the data and hold it for ransom.
Preventing phishing schemes requires staff training. They need to understand the risks of opening emails
and downloading attachments from unrecognized senders. Be sure to conduct training sessions with
images of phishing emails, pointing out common tricks like misspelled URLs, poorly constructed
sentences, and other signs of non-genuine emails.
Here are some other signs of phishing emails employees should be aware of:
• URLs do not match the purported business. Users can hover over the URL (place your curser
over the URL or email address) to see the real destination or address
• Emails asking for Social Security Numbers, bank account information, and other personal data
are always fake
• Emails that attempt to elicit panic and suggest the recipient ‘must act’ are always suspicious
• Phishing schemes often change to reflect current events, such as vaccination, political decisions,
COVID “cures”, and other hot topic issues
For employees, deletion is always the answer. If there is any doubt about the veracity of an email, they
can simply contact the organization or individual that sent the message. Institute a policy that no worker
will be in trouble if they delete a genuine email if they thought it came from a shady sender.
Managing Remote Workers: Flexibility vs. Safety
It is obvious remote work is here to stay. For new hires it is now considered a standard condition of
employment, instead of a rare sought-after benefit. With remote work comes inherent hazards for
businesses to manage devices and employee actions as they relate to cybercrime risks. Ideally, business
owners will provide employees with dedicated laptops and phones for work. These will come preloaded
with malware protection, firewalls, and strict access points for reaching company data. It is a better route
than ”BYOD” as workers tend to use their own devices for riskier behaviors that can offer convenient
entry points for bad actors.
There is also privacy and support benefits with corporate-provided devices. IT can control company
property without worrying about stumbling across an employee’s photos or their Facebook posts.
Cyber Defense eMagazine – November 2021 Edition 109
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.