As mail server administrators, we may have extensive knowledge on how to use email safely and securely, but what about end users? You do everything you can to block spam & malware, but if you don't educate your users and one of them clicks on a link in a spam message, your network can be made vulnerable. Consider these recent cases that could have been avoided if users were armed with the right information to identify phishing scams and other threats.
- CEO fraud (a scam in which the attacker spoofs the boss or CEO in order to trick someone into wiring funds to the scammer) and W-2 Phishing (in which scammers impersonate the boss in order to get access to employee tax forms) are being combined in new & more widespread attacks.
- A malware development team known as The Dukes may have been responsible for targeting think tanks and NGOs in multiple spear phishing attacks. These attacks purported to be from individuals at Transparency International, the Center for a New American Security (CNAS), the International Institute for Strategic Studies (IISS), Eurasia Group, and the Council on Foreign Relations (CFR). In addition to these spear phishing attacks, other attacks included less-targeted spam email blasts that contained Word or Excel documents. The recipient is instructed to enable macros which, when enabled, allow hackers to automatically download and run malicious code.
- Toy maker Mattel was hit with a phishing email requesting a new vendor payment to China. Their finance executive received the phishing email claiming to come from their new CEO. Standard protocol required two high-ranking officials to approve of these types of transactions. Because the finance executive and the CEO both qualified as high-ranking officials, she approved the transaction and wired over $3 million to the Bank of Wenzhou, in China. You can read more about this story here.
These are just a few high-profile incidents among many others that could have been prevented if the user had been better informed on email safety and security.
Email security isn't just the email provider or administrator's responsibility. It's everybody's responsibility. Here is a list of safety tips all mail server administrators should share with their users to help keep spam & malware to an absolute minimum
- Change your password often.
- Use strong passwords. Never use a password that contains "password" or "letmein".
- Use a different password for each of your accounts. If you use the same password for your bank account as you do for your email account, you become much more vulnerable to data theft.
- Don't open an attachment unless you know who it is from & are expecting it.
- Be cautious about email messages that instruct you to enable macros before downloading Word or Excel attachments.
- Use anti-virus software on your local machine, and make sure it's kept up-to-date with the latest virus definitions.
- If you receive an attachment from someone you don't know, don't open it. Delete it immediately.
- Learn how to recognize phishing
- Messages that contain threats to shut your account down
- Requests for personal information such as passwords or Social Security numbers
- Words like "Urgent" - false sense of urgency
- Forged email addresses
- Poor writing or bad grammar - Hover your mouse over links before you click on them to see if the URL looks legitimate.
- Instead of clicking on links, open a new browser and manually type in the address.
- Don't give your email address to sites you don't trust.
- Don't post your email address to public websites or forums. Spammers often scan these sites for email addresses.
- Don't click the "Unsubscribe" link in a spam email. It would only let the spammer know your address is legitimate, which could lead to you receiving more spam.
- Understand that reputable businesses will never ask for personal information via email.
- Don't send personal information in an email message.
- Don't reply to spam. Be aware that if you reply to a spam email, your reply most-likely will not go back to the original spammer because the FROM header in the spam message will most-likely be forged.
- Don't share passwords.
- Be sure to log out.
In many ways, your network is only as strong as its weakest link. Don't be that weak link. In addition to the tools administrators use to keep unwanted threats out, user education is key to keeping your network secure.
