Tutorials
How does Phishing Relate to Cybersecurity?
Have you ever received a suspicious email that set off all your mental alarms? Maybe it looked innocent enough, like a family member asking for your address so they can have something delivered. Or perhaps it was more urgent — an email coming from your boss, who just happened to forget some of the company’s most important passwords.
That was your mind warning you about a phishing attempt! These cyberattacks may look harmless at first glance, but they’re one of the most notorious types of scams in cybersecurity and cause costly damage to companies. Learn more about phishing scams, their dangers, red flags, and the steps cybersecurity professionals take to protect individuals from them.
An In-Depth Look at Phishing
Phishing is a digital and fraudulent attack used to steal a person’s personal information for gain or manipulation that uses social engineering methods. But what is social engineering? Let’s use a couple of examples in a non-digital setting. For instance, a criminal poses as an exterminator to gain access to an office building where he can steal valuable information. He looks the part, acts professionally, and pretends to be trustworthy to complete the mission. Another criminal may act like an insurance agent to gain the confidence of a company employee over the phone. He sounds informed, uses the right terminology, and even knows a few specific details about the employee’s company. However, he acts this way because his goal is to steal banking information.
These are both examples of criminals using psychological manipulation in in-person scenarios to trick people into providing access to confidential information. Phishing attacks employ these same tactics. The exception is they generally do it through email or text messages. At their core, phishing scams rely on the fact that humans are prone to mistakes and they exploit it knowing the nature of this attack can be difficult to combat.
The First Phishing Scams
Phishing made its way into the internet scene in 1996, when a community of hackers known as Warez began targeting AOL users. Their work began as an algorithm that produced valid credit card numbers which were then used to create new AOL accounts to scam other AOL users. Eventually, Warez incorporated social engineering methods, with members of the community posing as AOL personnel to gain sensitive information. Since then, phishing scams have evolved to use different forms of communication, but the methods have stayed relatively the same: target the individual with psychological manipulation.
How It Works
In its simplest and widely used form, phishing scams begin by establishing a sense of legitimacy. Cybercriminals will craft emails that sound legitimate. They may even supplement their initial message with phone calls or texts that add to their “genuine” request for information. Because these attempts rely on human interaction, their results depend on just how well they manage to manipulate the unsuspecting victim.
Types of Phishing Scams
Much like technology, cybercrime is always evolving. Cybercriminals are constantly on the lookout for new ways to exploit people. This unfortunately means there is a wide variety of phishing scams you can be exposed to. They include:
Types of Phishing Scams
-
Email
Perhaps the most common type of phishing attempt, email phishing is exactly what it sounds like: a cybercriminal sends an email requesting information outright or urging the victim to download malware or click a link to a malicious site.
-
Whaling
Also commonly known as CEO fraud, this phishing scam begins with cybercriminals finding the name of a company’s CEO or high-ranking official. They use this information to create an email account that may pass as the CEO’s own. This email account is then used to pose as the CEO and email employees in an attempt to gather intelligence, request money transfers, or urging them to download malicious software.
-
Clone Phishing
This method involves sending emails from addresses similar to ones the victim already interacts with. For instance, if an employee regularly interacts with members of a logistics company, the malicious actor will create an email that’s almost identical from the ones coming from said company to establish a connection with the employee.
-
Spear Phishing
This is a more involved method of phishing in which cybercriminals take time to research information about a specific person from a company through social media or the company’s website. They then tailor their email communication with real names, events, or phone numbers to increase legitimacy.
-
Vishing
This phishing scam is done over the phone or VoIP. However, many vishing attempts tend to happen during specific periods of the year. For instance, a cybercriminal may pose as an IRS official contacting someone during the peak of tax season.
-
Smishing
Take a phishing attempt and do it over texts (SMS) and you get a smishing attempt. They apply the same psychological methods over a different type of text service.
-
Search Engine Phishing
As opposed to sending emails or texts to employees, search engine phishing is when a cybercriminal uses a fake website that looks like the real thing to infect visitors with different viruses or trick them into providing their personal information.
-
Angler Phishing
Angler phishing takes the methods used in email and text phishing scams and applies them to social media applications, specifically direct messages. Social media additionally gives malicious actors the opportunity to collect information from individuals which they can then use in their phishing attempts. For instance, they may use the names of friends you tag in pictures or addresses from the places you frequent to establish a sense of legitimacy and familiarity with you as they attempt to phish you.
-
Pop-Up Phishing
This method involves cybercriminals using pop-ups to get individuals to install malicious software to their computers. While ad blockers have significantly decreased the effectiveness of these attacks, they remain a danger for less tech-savvy people.
The Red Flags
In 2014, Yahoo employees were targeted in a phishing campaign that caused a data breach that affected 500 million users. The company lost $1.3 billion in market capitalization and the scam remains one of the biggest cyberattacks in history. Knowing when a phishing scam is happening is one of the first lines of defense in prevention — and recognizing red flags is crucial. Some red flags include:
- Greetings such as “Valued Customer” that don’t address you by name
- Numerous spelling and grammar errors throughout the email
- Urgent language that nearly threatens you into complying with their request
- Links to other websites or attachments from sources you don’t recognize and look suspicious
- Requests for your personal information, banking information, or money
Cybersecurity’s Role
Cybersecurity is the process of protecting integral computer systems and networks from malicious attacks that can result in information and identity theft, disruption of services, or data leaks. As cyberattacks become more complex, the crucial need for protection increases in government agencies, companies, and other institutions. Cybersecurity professionals are tasked with proactively securing digital assets and vital information infrastructures.
In essence, the role of cybersecurity is to protect and prevent. One of the most effective ways it achieves its mission is through ethical hacking, or hacking for the greater good. A practical way to determine if an organization’s cybersecurity efforts are up to speed is to test them. A cybersecurity professional known as an ethical hacker is tasked with finding their way through a company’s defenses, much like a malicious actor would. This “audit” enables them to identify any weak points or vulnerabilities that need to be resolved. Once the test is complete and weak areas are found, ethical hackers can even provide potential solutions.
Cybersecurity Certificate Program
The Kenzie Academy Cybersecurity Certificate Program from Southern New Hampshire University (SNHU) addresses the need for qualified experts in the field. The program can be completed in 9 months and offers a curriculum developed in partnership with the International Council of E-Commerce Consultants (EC-Council).
Because the program provides practical, hands-on training that resembles real-world scenarios, it prepares learners to enter the cybersecurity field after graduation. Upon completing the program, you’ll receive our Cybersecurity Certificate and have the opportunity to take exams for 3 additional cybersecurity certifications: Network Defense Essentials, Ethical Hacking Essentials, and Digital Forensics Essentials.
Let’s Get Started
Imagine a career that lets you take a proactive stance against cyberattacks as you make a difference in the digital world. Now is the time to bring that vision to life! Kenzie Academy from SNHU prepares you with the skills needed for a rewarding career in tech across different sectors, including healthcare, logistics, finance, and so much more. We also assist you as you connect with like-minded learners and prepare for your job-seeking journey. Apply today and get started on a future in cybersecurity.
