What is Phishing?
Phishing is a method of attack that involves obtaining sensitive information by posing as a legitimate sender or contact and asking for information. This information can include passwords, account numbers, or even credit card numbers. This information can then be used to steal money or to download malware onto a victim’s computer.
Phishers often use a combination of methods to attack their targets, including email, phone calls, text messages, and website spoofing. While email is the most common way that phishing takes place, attackers can also use other tools such as vishing (phone calls posing as an organization employee) and whaling (targeting high level executives).
Although phishing has been around for a long time, it continues to be successful. This is not because people are stupid; it’s because phishing emails can be very well-designed and convincing. They look almost identical to the real thing and they trick busy employees into clicking on links, which can lead to fake websites or download malware.
While organizations can’t control the actions of individuals, they can set policies and practices to make phishing attacks more difficult to carry out. For example, employees should be instructed to never send money or provide credentials over email. They should also be encouraged to verify any requests for information by calling the person or organization directly and not using a link provided in an email. Also, if an employee is ever unsure about the authenticity of an email or phone call they should run a full security scan of their device and report any suspicious activity to their IT service desk.