The most frequent way that malicious software and other threats get into computers and networks is via malicious "phishing" emails designed to entice users into opening documents or clicking on web links that will result in the compromise of their computer. Spearphishing is a more focused type of phishing, where the "lure" is customized to the target organization or individual. Whereas broadly-targeted phishing emails may be relatively easy to detect, spearphishing emails can be very convincing and difficult to detect. Some tips to avoid being compromised by spear-phishing messages:
- Implement a good email security device or service. This will filter out the majority of phishing and spearphishing attempts.
- Check closely the "from" and "reply-to" addresses of suspicious emails. These won't always match for legitimate emails, but often in the case of spearphishing one or the other is an obviously inappropriate address.
- Check web links to see that they actually go where they purport to go. "Hover" your mouse pointer over the links to see the actual destination.
- Keep all software on client devices (particularly MS Office, Adobe Reader, Java, and Flash) fully patched. Most compromises result from the exploitation of known vulnerabilities for which patches are available.
Comments
Post a Comment