CS Jan-Feb 2024

phishing
Malicious actors who set up fake websites
are, of course, hoping to catch users off
guard. "The battle against domain phishing
scams demands unwavering vigilance," he
adds, "as most attacks prey on our busy
lifestyles, in the hope we won't notice things
are 'a little off', If something seems a little too
good to be true, or the website perhaps isn't
exactly how you remember it, it's always best
practice to double-check the domain URL or
the email address and language used in any
correspondence."
To be really sure, you can contact the
company independently to enquire about the
communication validity. Legitimate companies
will generally have a website accessible from
a search engine where anyone can find their
details. Taking a proactive approach will stand
you in good stead to pick up on anything
suspicious, says Herbert.
"We would recommend you visit the website
of the company that any questionable email
claims to be from to see if there are any
announce-ments about phishing attempts.
Having said that, just because there hasn't
been one before doesn't mean there won't
be a first!
"For businesses, implementing basic levels
of cyber hygiene, like technical measures of
threat identification and mitigation, is a good
first step, but unfortunately this often isn't
enough," he continues. "For peace of mind,
it's best practice to invest in a positive security
culture, regular security awareness training
and pen testing - these are simulated phishing
attacks that will help you determine the
effectiveness of staff awareness training.
Deficiencies in process or employee blind
spots can then be rectified."
STAY VIGILANT
Durali Cingit, incident response analyst
at Integrity360, states that the important
questions to ask when it comes to accessing
a website and establishing if it is legitimate
or a phishing one are: "How did I get here,
directly or indirectly? Did I click on a link from
an email? Did I use a search engine to get to
this website? Have I been redirected to this
website from a link?" These questions will help
to keep you safe.
"In order to distinguish the real from the
fake, there are a few details to look out for on
websites," he advises. "First, you want to check
the URL of the website; safe and secure websites
all begin with 'HTTPS://' and, depending
on the browser you use, you will see a green
padlock or the URL bar will be green as an
indicator that this website is secure.
However, threat actors have also adapted
and evolved into now making their websites
secure to fool users into thinking that the fake
website is legit, so it's not enough to rely on
this alone." Also, the 'About Us/Contact Us'
page should provide a contact form or an
email address, which can be a key indicator.
"These pages are normally populated with
different ways in which you can contact the
organisation, whereas a phishing website
may only contain one source of contact
information."
Finally, he suggests, you should ask yourself
the 'How did I get here?' question. "The main
tactic threat actors use to get users onto
a phishing website is either through email
or SMS message. Users should be alert and
cautious as to who sent the email. If they
were expecting an email form the sender, is
the email asking them to click on a link or an
attachment, which more often than not will
redirect the user to a phishing website.
"Same procedure with SMS text messages
where users fall prey to fake text messages -
eg, from the bank with a link that will ask the
user to log in, in order to steal their financial
login details."
He also advises organisations to sign up to
programmes that make it mandatory for all
employees to take part in being educated on
phishing and the signs to look out for.
Brian Lonergan, Identity Digital: we have
more helpful means at our fingertips
than ever before to stay ahead.
Steve Herbert, Nominet: in just three
months, his company identified and blocked
more than 450 fake shops using .UK
domains.
www.computingsecurity.co.uk @CSMagAndAwards Jan/Feb 2024 computing security
23