From rewarding employees for savvy security smarts, to showing them how breaches are relevant to their every-day duties, we’ve got the phishing prevention tips you need.

Most of us have clicked on an email that seemed legitimate, but wasn’t.

Here are our top phishing prevention tips for best technology practices, employee education and social media smarts.

3 ways to stop 95-99 percent of spear-phishing attempts

1. Inbound email sandboxing

Deploy a solution that checks the safety of an emailed link when a user clicks on it. This protects against a new phishing tactic that I’ve seen from cybercriminals. Bad guys send a brand new URL in an email to their targets to get through the organization’s email security. The other tactic is when they inject malicious code into the website right after delivery of the email URL. This URL will get past any standard spam solution.

2. Real-time analysis and inspection of your web traffic

First, stop malicious URLs from even getting to your users’ corporate inboxes at your gateway. Even if you have inbound email sandboxing for your corporate email, some users might click on a malicious link through a personal email account, like Gmail. In that case, your corporate email spear-phishing protection is unable to see the traffic. Bottom line: your web security gateway needs to be intelligent, analyze content in real time, and be 98 percent effective at stopping malware.

3. Employee behavior

The human element is incredibly important. Adopting an employee testing program and do this training on-going basis. The result isn’t really employee education or security awareness —it’s behavior modification.

5 tips for changing employee behavior

1. Pen-test your organization

Employees are critical to your security success, spear-phishing defense and ability to prevent a data breach. Below are five ways you can turn them into security advocates.

One of the best ways people create new behaviors is by making a mistake and being corrected. It’s time to put your black hat on. Select a group of folks from each major department and send them targeted spear-phishing emails using an outside email address. Use only information you can locate on their social media sites (Facebook, Twitter, LinkedIn, etc.). For example, you see they like a local sports team. Send them information about a local happy hour that supports the team. When they click on the link, inform them that they have been phished and communicate best practices in a positive way.

2. Ask marketing for help

Start a partnership with marketing to help you communicate to your employees. Your marketing team specializes in communicating to different audiences to get them to take action. It’s time to use their skills. Create a communication plan that both teams can execute against and track what methods are the most effective.

3. Change how your message is communicated

Some people learn visually, others learn audibly and for many, it’s a combination of both. Change how your security message is delivered to employees. Start with a monthly email, webinar and Intranet post. Switch it up with in-person trainings and videos. Using these different mediums will help your message resonate with more employees. Remember, you will need to communicate a message multiple times for it to stick.

4. Make security relevant to them

Just asking employees to watch out for suspicious-looking emails doesn’t drive home the urgency of spear-phishing. Rip it from the headlines. When a large company makes headlines for a data breach, because an employee opened an infected email, immediately communicate how something like that could happen to your employee base. It’s well-timed, newsworthy and will be on your executives’ radar.

5. Reward good behavior

IT security is known for doom and gloom, but what if you change that perception? Start rewarding your employees for a “Catch of the Day.” Start an internal contest that asks employees to forward suspicious emails they receive (both from their personal and work accounts). Pick your “Catch of the Week” every Friday, reward the employee with a $100 gift card to Starbucks, and publicize the spear-phishing attempt for other employees to see.

3 things to never post on social media

Social networks are gold mines of personal information for cybercriminals, especially for targeted spear-phishing emails. Below are three things IT security professionals shouldn’t discuss online.

1. Any birthdays/addresses/other items. that are used for your network passwords

We know you use these for passwords despite our best advice. Don’t also advertise them on social media.

2. Your vacation schedule and home photos

It’s like an advertisement for when you will be out of town, while doing reconnaissance for the criminals.

3. Your phone number

Cybercriminals are getting more creative. More and more criminals are calling targeted employees and asking for information. For example, some criminals call and pretend they are from their help desk and need to reset passwords. When in doubt, go with your gut. If something seems off or you don’t know the person, ask for their contact information and look into it. Ultimately, its better to be safe than polite.

Phishing isn’t going anywhere. As long as people use social networks and email continues to be a key workplace communication channel, spear-phishing will be a weapon of choice for cybercrime.

Courtesy: csoonline.com