1

I'd like to know what the best methods are to prevent success of phising mails.
This question contains the following subquestions:

  • What are the best ways to determine incoming phising mails (on a Server and Client side)?
  • What types of attachements/senders should generally be blocked?
  • How do I explain/train my users that they shouldn't trust every mail that they're getting?

If you think that there are more relevant questions on this topic, feel free to edit or let me know.
If you have additional information about the topic, feel free to add it to your answer.

Edit: I edited my question to be more clear, although the question you linked answers some of my question, it does not go into the same direction and most of my question is still unanswered. Thanks.

Mike
  • 13
  • 4

2 Answers2

1

There is no one answer to this, a number of things can help, spam filters will help, but A.They won't catch everything and B. They might filter legit email (especially if you have it set to be very aggressive.) It is really a trade off.

When explaining to users the best thing is general user education.
Explain the risks, explain what to look out for and include them in the process by giving them stakeholdership over the issue, it is their problem as much as it is the organisation's problem. Explain to them that everyone has a role to play when it comes to security.

I have dealt with many diverse user groups over the last few years and have had to relay a number of IT change projects to them and making them feel part of the process has consistently been key to getting them to do is needed/wanted. The standard advice would be as follows;

  • Check the domain in the email address is correct. For example if you get an email from someone claiming to be from the Acme Bank make sure the domain part is consistent with other emails you have from them; i.e manager@acmebonk.com is the sender address but Acme Banks email is @acmebank.com.

  • If you haven't had any other mail from them, then why are you getting email now? Do you even have a service with them, if not then
    something may be wrong.

  • Check the URL's in the mail are legit, visit the website in a browser and confirm the domain is the same as the links.

  • Any attachments can be risky, it doesn't matter what they are, there is a risk and an attack vector in anything that can be attached to an email.

TheJulyPlot
  • 7,669
  • 6
  • 30
  • 44
1

There is no such thing as bulletproof security. What could be done is to use a text based mail client such as mutt. This way, you'll see the link instead of being able to click on it. Also you can try a good spamfilter and setting it tight.

There are multiple phishing training frameworks. For example the Simple Phising Toolkit, which you can use to educate your employees.

aentgood
  • 31
  • 7