Phishing alerts to employees

Employee phishing alerts are a critical tool for the protection of corporate data.  Phishing is a sneaky and highly effective technique, and, within a business, it is important to keep one’s guard up by monitoring email traffic, raising awareness of corporate security, and notifying employees in a timely manner with appropriate phishing alerts.

1. What phishing is

Phishing is a fraudulent personal attack technique that, through communication, aims to extort sensitive data, in particular, users’ personal or financial information. Phishing is based on sending fake emails, SMS, or chat messages which appear to come from legitimate sources (e.g., banks, health care facilities, private companies, and public institutions).

The purpose of phishing is to trick users into clicking on infected links, to open malicious attachments, or to enter their data into counterfeit websites.  Phishing can cause serious damage, such as identity theft, withdrawal of money from a bank account, or unauthorized access to online services.  Phishing attacks are always massive, that is, generally a phishing campaign spreads to thousands of users, with the certainty that some distracted, unfortunate person will fall for it.  Often the campaigns are very well designed:  the sites or landing pages are very similar to what is expected, and the messages are particularly convincing.  A typical example involves a notice about problems in receiving a parcel which is being delivered, or even a request to urgently update or correct login details for a particular service, for example, home banking.

>> FlashStart protects you from a wide array of threats and blocks access to malicious sites. Request a quotation or try it now

2. The risks for businesses

The repercussions of a phishing attack on a business can be considerable.  It may be the case that the user is asked for access to services, software, or otherwise corporate assets.  Once acquired, the attacker can break into company systems as if he or she were an authorized employee and carry out various criminal activities, for example, stealing information, freezing data for ransom, or blocking corporate services.

The increasing usage of personal devices to access corporate IT systems amplifies the risk.  So does access to the same by family members or, even, access to the corporate network from the outside in smart working mode.

It should also be noted that the use of laptops, tablets, and smartphones on the move does not help.  Evidence shows that, in mobile conditions, one is more vulnerable and less careful, risking being misled more easily.  Finally, emblematic cases of “corporate” phishing include the message, or even phone call, from a supposed superior who, under the guise of being in trouble, asks for login information or money to be credited to a fake account. 

In a nutshell, although phishing is a personal attack, the consequences for a business can be dramatic. That is why it is essential that the problem be addressed with proper training and specific activities such as, for example, phishing alerts to employees.

>> FlashStart protects you from a wide range of threats and blocks access to malicious sites → Request a quotation or try it now

3. Phishing alerts to employees and other actions

It is important that activities are introduced into the company in order to protect corporate devices and IT infrastructure.  Whether phishing attacks or other types, the strategic direction must focus on prevention and blocking.  In the former case, it means making employees aware of the importance of protecting corporate and personal data and of recognizing the dangers through training, updates, and regular communications.

In the case of phishing, for example, it would be useful to prepare a manual to be distributed, and, perhaps, even printed and posted in the company.  Just a few, clear, rules of conduct would suffice:

» Think before clicking on a link (check grammar, url, type of request, and sender)

» Think before posting sensitive information on the web (it can be used by cyber criminals)

» Always use a secure remote connection and a browsing monitoring tool (find out what they are in the last paragraph)

» Be especially careful not to download any executable file from a message.

In addition, it is essential to monitor browsing activity and email traffic, again while respecting employee privacy, in order to detect the type and extent of an attack in time.  There are special protection services for this, but they intervene when the event is in progress.  This means that, at this stage, the goal is to block the propagation of an attack and limit the damage.  Clearly, it is more effective to invest resources and time in preventive measures, that is, in educating employees on how to recognize suspicious messages, particularly phishing messages.

Among the communication processes to be introduced, once a phishing campaign has been intercepted, is definitely the phishing alert to employees.

>> FlashStart’s artificial intelligence guarantees continuously updated protection for your browsing → Request a quotation or try it now

4. How to implement phishing alerts for employees

In order to implement a phishing alert for employees, first and foremost, one must have full control over the email traffic and messages arriving on corporate devices.  For this, as mentioned, one can use modern monitoring application services based upon artificial intelligence, particularly machine learning.  In addition, it is good to subscribe to an alert service that warns of an attack in progress within a certain geographic region, at particular facilities, or at specific vertical markets (manufacturing, healthcare, public administration, finance).

Once a potential danger is identified, corporate security officers should immediately prepare a phishing alert for all employees.  This involves one or more email communications which should be carried out with some care.

However, an initial communication, sent periodically, should help employees recognize phishing emails, with the inclusion of the warnings we have explained above.  One could also set up a follow-up email campaign, diluting the messages, as a kind of distance learning.

In particular, in the text, one should remember to doubt messages of an urgent nature or with alarming words which cause anxiety.  Again, verify the sender and, perhaps, make sure with a phone call that he or she is the one who sent the message.  Next, check the link carefully, and if the path is not clear, do not click.  Finally, beware of links from public networks, and always forward any suspicious emails to company officials.

Another useful activity is to fabricate and send fake phishing emails to employees.  In this way, it is possible to figure out which employees need more security training.  The activity should take place at the end of a training course, but also periodically as a surprise.

Once a phishing communication has been intercepted, it is important for security officers to send a phishing alert to employees.  It should be a clear email, informing them of the attack, perhaps with an attached image of the message (image, not copy-and-paste text), and reminding them of what to do to avoid the danger.  Finally, the tone of the communication must be reassuring.  It is necessary to show that the situation is under control and to avoid further anxiety.

5. An example of a phishing warning email for employees

Here is an example of a phishing warning email to forward to all employees:

Dear [employee’s name],

We are notifying you that we have intercepted several phishing messages addressed to colleagues. The messages bear text similar to what you find in the attached image and attempt to convince you to click on an infected link in order to then take possession of sensitive data. 

We are already working to prevent further consequences but, for this reason, we need your help and utmost attention.  We take this opportunity to remind you of the golden rules in order to help you recognize a phishing message and avoid damage to yourself and to the company.

Thank you for your attention; if you need any clarifications, please do not hesitate to contact us. 

The head of corporate information systems

6. How to protect oneself from phishing and other dangers

A malicious site is always accessed by a click to a message, a text message, an email, a chat message.  Most of these messages are phishing messages, according to the definition we have already given.  So, the first thing to do to protect oneself is to learn to recognize the attacks.  Your bank, for example, will never contact you by SMS to tell you to change your password, nor will the courier company that is carrying a shipment in your name.

Secondly, to avoid running into examples of malicious sites, it is advisable to have a filtering service for browsing, a DNS filter.  Many DNS filters are too sophisticated, complex to install and manage, and expensive. However, there are ones that are perfect for use in households, government, and educational institutions.  FlashStart’s DNS filter is the right choice for those who want a monitoring service for browsing which is easy to configure, customize, and always up-to-date.

FlashStart’s DNS filter carefully analyzes all stops on a path which makes a request to access a site.  The filter also uses machine learning algorithms to rule out dangerous paths a priori, thus speeding up the check.  In addition, FlashStart uses up-to-date and reliable DNS logs to analyze paths from user to requested site. 

Capable of filtering about two billion website queries, FlashStart DNS protects the browsing of twenty-five million users every day, is present in more than 140 countries worldwide and in about ten thousand businesses, schools, and public administrations, and is delivered, also in the form of a service, by 700 certified partners.

In conclusion, why choose FlashStart’s DNS filter to control internet access?  Let’s summarize its seven distinctive points:

» Frequent updating of blacklists:  FlashStart checks 200 thousand new sites per day.

» Guaranteed low latency (that means the speed between request and access).

» Ninety categories of malicious sites and geoblocking to isolate dangerous countries.

» Use of artificial intelligence to improve the quality of blacklists and for latency.

» Ease of configuration and management.

» Native integration with Microsoft’s Active Directory to speed up the work of system administrators in schools, institutions, and SMBs.

» Worldwide LAN protection and roaming on end points via Anycast network.

7. FlashStart: an authoritative source for ScamAdviser and GASA

Web scams are an exponentially growing phenomenon. For years now, it has reached a volume of more than $50 billion annually. In the pandemic period, due to social restrictions, the Internet has experienced unprecedented growth, both as a tool for entertainment and for work. The increase in traffic as connection time and number of users has resulted in a parallel increase in cyber crime and in particular online scam attempts.

FlashStart is the European leader in DNS Security, among the world’s biggies in cloud-based protection with Artificial Intelligence. With the support of Machine Learning it constantly scans the web to catalog new domains and classify their activity within 100 categories. A very easy-to-use control panel allows MSPs, ISPs and IT Providers to filter Internet access to undesirable categories, be they malware, illicit activities, dangers to minors, or even simply sources of distraction in educational and work-related areas (streaming, games, social networks, etc.).

FlashStart’s partnership with the Global Anti Scam Alliance (GASA) and, as of 2022, with ScamAdviser, referred to as an authoritative source of “trust,” marks an important milestone that reinforces the company’s mission by demonstrating that it has long enjoyed an established global reputation.

In fact, FlashStart’s European technology is at the level of its American competitors and in some respects even superior. In fact, FlashStart in addition to DNS filtering is the only platform to have implemented a geographically based protection system to completely prevent traffic to servers located in areas of high malware risk and compromise.

FlashStart operates globally, with customers in 156 countries around the world, but can only be purchased through authorized resellers (ISPs, MSPs, OEMs, IT vendors, etc.).
It offers excellent margins for the channel and simultaneously attractive prices for end users, so it is the most cost-effective solution for protecting businesses, government agencies, schools, and households.

You can activate the FlashStart® Cloud protection on any sort of Router and Firewall to secure desktop and mobile devices and IoT devices on local networks.