E-mail policies -- A defense against phishing attacks

Phishing: Cutting the Identity Theft Line By Rachael Lininger and Russell Dean Vines                          334 pages; $29.99                     John Wiley & Sons

In this excerpt of Chapter 6 from Phishing: Cutting the Identity Theft Line, authors Rachael Lininger and Russell Dean Vines explain how e-mail policies help protect companies from phishing attacks.

Interacting with customers

Not surprisingly, the first line of defense in the phish fight is the customer. Creating easily understandable standards for customer communications can go a long way in preventing a phishing attack and recovering quickly from one.

E-mail

E-mail is currently the largest attack vector for phishing malware and ID theft exploits. This may change, as Web sites increasingly begin to employ advanced scripting techniques and automated functions; but e-mail is still the hands down winner.

You can take a number of steps to protect your business from fraudulent e-mail, including the following:

• Standardizing your communications with the customer
• Implementing e-mail authentication

The following sections discuss these topics in more detail.

Information Security Bookshelf Read Chapter 6, Helping Your Organization Avoid Phishing Sound Off on this book excerpt More book chapters and reviews Learn more about e-mail security in E-mail Security School

Standard customer communication policy

Even if you're not a financial institution, as an ISP or Internet company you should have a customer e-mail policy. Policy is one of those terms that can mean several things. For example, there are security policies on firewalls, which refer to the access control and routing list information. Standards, procedures and guidelines are also referred to as policies in the larger sense of a global information security policy. For example, a policy can provide protection from liability due to an employee's actions, or it can control access to trade secrets.

Companies need many types of policies, standards, guidelines and procedures. But what I'm talking about here is creating a standard for e-mails from the company to the customer, which doesn't use the types of phish hooks you see in a phishing e-mail. A standard customer communications policy should convey a consistent message and not confuse your customer.

Here are some basic customer e-mail policy standards:

• Don't send e-mail in HTML format.
• Don't send attachments.
• Don't include or ask for personal information.
• Use the full name of the user.
• Don't include hyperlinks.
• Use localized messages.

Read Chapter 6, Helping Your Organization Avoid Phishing.