email security awareness
Post on 08-May-2015
651 Views
Preview:
DESCRIPTION
TRANSCRIPT
{
Email Security Awareness
Tips to protect yourself from some common email dangers & scams
The driving force is MONEY! Drive you to a site to sell you something Scams, advanced fee, lottery Collect personal information Fake AV, Scareware! Ransomware! Stealing login credentials
Key loggers Attackers are finding ways to compromise
computer, passwords, data, accounts Easier to hack people then find way into
company network through perimeter defenses
Protect Yourself
Password may be only line of defense for email account
Don’t reuse passwords for all online accounts Compromised password could give access to multiple
accounts or sites Avoid common words, names, birthdays Use passphrase, mix upper and lower case letters,
numbers, and special characters Minimum 14 characters Never keep passwords on sticky note on monitor Login page using HTTPS required when using
unsecure network (public Hot Spot) https://
www.microsoft.com/security/pc-security/password-checker.aspx
Strong Passwords
Sense of urgency! Act now, respond now, need help Don’t think, just click! NOW, NOW, NOW!
Alarmist messages and threats of account closures Any email requesting personal information, bank
account, credit card number, access codes, etc… (Phishing)
Spelling errors, grammatical errors Promises of money for little or no effort
Work from home (money mule scams) Generic greeting, Dear Customer Request for help, related to urgency scams, emotional
pull Sender in foreign county needs help and money
Tips to Avoid Scams
Send money up front to receive prize Deals that sound too good to be true Free may have a price tag!
Electronics, iPads, gift cards, lottery scams, inheritance scams etc…
Downloads and attachments Fake software updates
Holiday scams, ecards (zip file attachment or links) May lead to unwanted software being loaded on
computer, Trojan horse program with key logger, fake AV, bot, rootkit, etc…
Senders email address Email may claim to be from BOA, but sender address
is not related to company, EX johndoe@badguysite.com
Tips to Avoid Scams
Requests to donate to a charitable organization after a disaster that has been in the news
Shortened links, or confusing links Redirect to bad guys site Go directly to company web site if in doubt
Chain letters May be collecting addresses for spammers
Unsubscribe links, may confirm live email account Junk Mail in GroupWise Report as spam or set up filter to block future emails
(Gmail, Hotmail, Yahoo, etc…) Similar scams may arrive as instant messages,
Skype, Facebook posts, Twitter DMs Social networking is a huge target for scams
Tips to Avoid Scams
No! I don’t need cheap meds! Not malicious Similar to postal junk mail Usually selling merchandise or advertisements Link to ecommerce website
Drive customer to website selling products or offering services
Spam
The number “419” refers to the article of the Nigerian Criminal Code dealing with fraud
Started before email as Spanish prisoner scam Many variations,
Iraqi gold, blood diamonds, inheritance or investment scams, etc…
Advanced fee scams Usually involve millions of dollars Assistance is needed, transfer money to you and
you earn percentage, catch is paying fees or taxes up front
Made to believe paying fees or taxes will lead to “bigger” prize!Nigerian 419 Email
Scams
There is no big prize or reward! Do not respond Delete message Junkmail, report as spam
Don’t Respond
URGENCY! Dire need of help! Receive email from friend or relative that is in
foreign county and has been robbed Needs money to settle bills
Robbed in London
Call person, try to speak to person to verify their location
Never in country that email claims! Senders email account has been hacked or
accessed by unauthorized person Bad guy sending email to all contacts in address
book Person is unaware account was hacked and
“fake” emails are being sent Person should change password to account
immediately Check for forwarding rules Contact ISP or email provider for assistance
Never Respond
To obtain information for the purpose of fraud or identity theft
Account may be locked or suspended Have short time frame to verify
Problem with payment or credit card Verify login credentials Email account storage limits URGRNCY pull is involved
Phishing
Can use company logos Copy from web site
Look and feel authentic Links do not go to actual company website Shortened links, bit.ly
Redirect to bad guy site May sign name of actual employee with
company Senders email address is not related to
company
Phishing
Phishing Video http://
onguardonline.gov/media/video-0007-phishy-office
Phishing
More specific Targeted audience Directed at specific company, people at certain
levels in company or in certain departments
Spear Phishing
The name is derived from SMS Phishing, SMS (Short Message Service) is the technology used for text messages on cell phones
URGENCY! (Voice phISHING) it is the voice counterpart
to phishing. The caller can ask for personal information or direct user to malicious website.
Support call to download “fake” software update.
Caller ID numbers and names can be spoofed.
Smishing
Smishing Example
Never reply to an email to verify personal information, bank account numbers, credit card numbers, passwords, etc…
Call bank or credit card company directly Verify if they sent email
Some companies have ways to report suspected fraud emails
Don’t Respond
Microsoft and Adobe never send updates through email
Attachments will not update programs, but load unwanted software
Links will not take to you to company web site or download attachment
Go directly to company website Microsoft Updates through IE Check for updates in Adobe Reader Run PSI or Qualys Browser Check to verify
updates are available
Software Updates
Work from home scams Make money part time, spare time
Have computer you can make thousands of dollars
Open bank account, bad guy deposits money, you transfer, or with draw money and wire it to someone, and keep percentage
No legitimate company works like this!
Money Mule Scams
Zeus Trojan bust reveals sophisticated 'money mules' operation in U.S. (September 2010)
https://www.computerworld.com/s/article/9189038/Zeus_Trojan_bust_reveals_sophisticated_money_mules_operation_in_U.S
In the News
Phishing Game http://
onguardonline.gov/media/game-0011-phishing-scams
Scam and Spam Game http://
onguardonline.gov/media/game-0012-spam-scam-slam
For Fun
http://ilookbothways.com/spot-the-spam/ http://
www.microsoft.com/security/online-privacy/phishing-symptoms.aspx
http://onguardonline.gov/topics/avoid-scams
Additional Resources
top related