Dodge phishing attacks and spam

ANTI-SPAM

– Run a consolidated email filtering solution at your email gateway, and use a good AV product.
– If you don’t know who sent it, especially if you are not in the TO: or CC: part, delete it.
– If the subject looks mangled so it could get by perimeter spam sensors, delete it.
– Have a good email policy in your business or organization, and also for your family at home.
– Don’t open email attachments unless you are prepared to infect your computer with a virus.
– Never ever open unsolicited MS Word or MS Excel or any other MS Office document.
– Never make a purchase from an unsolicited email, or give out your credit card numbers.
– Use a disposable email address when signing up for websites to avoid unsolicited email.
– Don’t click the unsubscribe link, which can add your email address to more spam lists.
– Avoid using the preview functionality of your email client software to avoid inadvertent infection.
– Don’t post your email address on every single message board you visit like some people do.
– When mass mailing, use BCC (blind carbon copy) to conceal recipients from one another.

ANTI-PHISHING

– Phishers make a fake site that looks like the real website to collect private information.
– Never respond to emails that request personal financial information or identity information.
– Banks or e-commerce companies generally personalize emails, while phishers do not.
– Visit bank sites by typing https://www.bank.com to have a securely encrypted connection.
– No matter how well you think you know someone from the internet, you don’t know them at all.
– Vigilently keep good track of your finances and credit report to check for suspicious activity.
– If you’re unsure of a link, search for the URL in a search engine to check its legitimacy.
– Use the latest version of your favorite Internet browser and allow script only on sites you trust.
– Keep your computer patched with all of the latest updates from your operating system vendor.
– If you think your bank has emailed you, call don’t click. Especially if it seems very urgent.
    Ask a customer service representative for help on the phone.
– If your financial institution calls you: hang up, call them back. Always initiate the call.
– Phishers often send false but sensational messages to socially engineer you:
      (“urgent – your account details may have been stolen”)

Following these steps cannot keep you 100% safe but it will reduce your risk against attack.

This entry was posted in General InfoSec by Troy Vennon. Bookmark the permalink.

About Troy Vennon

I recently separated from the U.S. Marine Corps after 8 years. I spent the first 3 1/2 years building classified and unclassified networks all over the world. There was a natural progression from building those networks to securing those networks. My last 4 1/2 years in the Marine Corps took me to Quantico, Va where I was stationed with the Marine Corps Network Operations and Security Command (MCNOSC). While with the MCNOSC, I was a member of the Security section, which was responsible for the installation and daily maintainance of the 34 Points-of-Presence that made up the Marine Corps 270,000+ user network. After a period of time with Security, I moved over to the Marine Corps Computer Emergency Response Team (MARCERT). There I was the Staff Non-Commissioned Officer of the MARCERT, which was responsible for the 24x7 monitoring of network traffic across the Marine Corps. Specifically, we monitored network traffic for malicious intent and investigated any network incidents as they occurred. While with the MCNOSC, I attained my CISSP, CCNA, and OPST (OSSTMM Professional Security Tester). I have been with MicroSolved for the past 4 months as the Senior Security Engineer, Technical Lead, and Project Manager.

Leave a Reply