What Is Phishing?
How does phishing work?
- Phishing attacks are the practice of sending fraudulent communications that appear to come from a reputable source.
- It is usually done through email. The goal is to steal sensitive data like credit card and login information, or to install malware on the victim’s machine.
- Phishing is a common type of cyber attack that everyone should learn about in order to protect themselves.
Contact Cisco
-
Call Sales:
- 0800 404 7778 (UK)
- 9 am - 5:30 pm
Q & A
Which security technology is the best?
No single cybersecurity technology can prevent phishing attacks.
What are the dangers of phishing attacks?
Sometimes attackers are satisfied with getting a victim’s credit card information or other personal data for financial gain. Other times, phishing emails are sent to obtain employee login information or other details for use in an advanced attack against a specific company. Cybercrime attacks such as advanced persistent threats (APTs) and ransomware often start with phishing.
How to sensitise users to phishing attacks?
One way to protect your organisations from phishing is user education. Education should involve all employees. High-level executives are often a target. Teach them how to recognise a phishing email and what to do when they receive one. Simulation exercises are also key for assessing how your employees react to a staged phishing attack.
Examples of phishing attacks
Spear phishing
Spear phishing targets specific individuals instead of a wide group of people. Attackers often research their victims on social media and other sites. That way, they can customise their communications and appear more authentic. Spear phishing is often the first step used to penetrate a company’s defenses and carry out a targeted attack. According to the SANS Institute 95% of all attacks on enterprise networks are the result of successful spear phishing.
Whaling
When attackers go after a “big fish” like a CEO, it’s called whaling. These attackers often spend considerable time profiling the target to find the opportune moment and means of stealing login credentials. Whaling is of particular concern because high-level executives are able to access a great deal of company information.
Pharming
Similar to phishing, pharming sends users to a fraudulent website that appears to be legitimate. However, in this case, victims do not even have to click a malicious link to be taken to the bogus site. Attackers can infect either the user’s computer or the website’s DNS server and redirect the user to a fake site even if the correct URL is typed in.
Deceptive phishing
Deceptive phishing is the most common type of phishing. In this case, an attacker attempts to obtain confidential information from the victims. Attackers use the information to steal money or to launch other attacks. A fake email from a bank asking you to click a link and verify your account details is an example of deceptive phishing.
Office 365 phishing
The methods used by attackers to gain access to an Office 365 email account are fairly simple and becoming the most common. These phishing campaigns usually take the form of a fake email from Microsoft. The email contains a request to log in, stating the user needs to reset their password, hasn’t logged in recently, or that there’s a problem with the account that needs their attention. A URL is included, enticing the user to click to remedy the issue.