Winning Back Your Business with Anti-Phishing Solutions
Over the past few years, phishing attacks have become more versatile, sophisticated, and dangerous. In order to win the battle against these fraudsters, the anti-phishing solutions we choose must follow the same logic and offer a variety of approaches that address every vulnerability. Jurgen Sorton, Head of MIT at Vox Telecom, was right in saying that “a holistic approach is required, one that includes security specific solutions, awareness training as well as changes to internal accounting controls.” We’ve seen the positive results of such an approach in many cases and witnesses Levi’s® fending off hundreds of potential attacks in a single month.
The fab four: Anti-phishing solutions & processes that can help you reclaim your businesses & brand
1.Content-based solutions
Many types of anti-phishing solutions focus on content that appears on social media posts, emails, website forms, images, and more. Content-based solutions capture and analyze the content to spot mistakes and suspicious behavior. Sophisticated technologies learn to identify even the most subtle issues to detect content-based attacks, and anything that doesn’t suit the brand or the situation in question raises a flag.
Use case example: In the Apparel industry, we see a lot of phishing attempts that create and promote fake social media pages offering special discounts. By closely examining the content published on these pages and comparing it with what is known about this particular brand and the industry in general, anti-phishing solutions are able to catch the fraud and handle it.
2. Non-content based solutions
Non-content based phishing solutions do not analyze the content itself and instead focus on elements such as domain monitoring and website registration data. On social media, for example, they will not examine the phrasing of the post but rather its creation and publishing times. When using non content-based solutions, problematic domain names are tracked and analyzed, page rating is taken into consideration, and an ever-growing database of whitelisted and blacklisted links is used to identify any suspicious behavior.
Use case example: Financial companies have access to massive amounts of sensitive information that is coveted by cybercriminals. Research shows that about 70% of finance companies located in the UK faced a security issue in the last 12 months . Financial online forms often do not include much content, and so the non-content elements provide the information which could reveal the fraud.
It’s important to monitor digital platforms that are not owned by the company, such as social media networks and phishing sites.
3. Refreshing company procedures
Company procedures should be updated and implemented on a regular basis, in order for the latest data to be properly protected and the newest employee to know the drill. The process includes routine backup, testing and restoration processes, and recovery methods for ransomware attacks. It also requires thorough explanations regarding the treatment of confidential company information and critical applications and assets.
Use case example: Unfortunately, too many SMEs fail to develop adequate company procedures like routine data backups and tested disaster plans. A recent study found that 43% of SMEs in the US and the UK do not implement any plan at all. This leaves any website, marketplace and company page exposed and in the case of an attack, increases the time it takes to mitigate the threat and subsequently the damage that the company and its customers would suffer.
4. Training and awareness
At the end of the day, phishing attacks are designed to mislead humans, and so understanding our vulnerabilities is an important part of the solution. The behavior of both company employees and users should be monitored and invested in routinely. Identifying the ways in which phishing attacks manage to trick users can help companies focus on the right type of anti-phishing solutions, as well as promote specific information. The training process needs to include both educational procedures and simulations to help companies assess the readiness level and allow employees and users to fully comprehend the logic behind phishing attacks.
Use case example: Pharmaceutical companies deal with the selling and reselling of fake drugs on behalf of the company on different platforms. The COVID-19 pandemic has contributed to the popularity of these attacks as it made medical companies the focal point of users and attackers alike, which led the US Department of Justice to issue a special warning on this matter. As part of the solution, companies should educate employees on how to identify suspicious communication with potential hackers, as well as inform their customers regarding the possibility of encountering fake drugs and how they may spot and report such fraud.
The comprehensive approach wins the game
While some security companies provide added value by focusing on the educational efforts required for businesses to meet compliance guidelines, a substantial part of the solution should be focused on the technological aspects. BrandShield provides comprehensive, technology-based protection that keeps brands safe by detecting different types of threats, analyzing multiple forms of information, and following through with advanced takedown capabilities. This comprehensive approach allows security teams to proactively manage the risk by using every tool and technique available. It is recommended to cover every angle, including employee training, in order to reach the highest level of protection and keep the brand secure.
Use case example: In 2020, BrandShield’s solution proved effective in protecting the world-renowned Levi’s® brand. During the month of April, BrandShield identified and mitigated more than 400 fraudulent domain names that attempted to scam company customers. By preventing these attacks, Levi’s® not only protected its audience but also the brand’s strong reputation as a secure company that puts customers first.
Brands looking to truly defend their business should focus on solutions that handle phishing attacks from every angle and are proactive in terms of detection and mitigation. Contact us to learn what it means for your specific industry and brand.
