In this excerpt of Chapter 6 from Phishing: Cutting the Identity Theft Line, authors Rachael Lininger and Russell Dean Vines explain how e-mail policies help protect companies from phishing attacks.
Interacting with customers
Not surprisingly, the first line of defense in the phish fight is the customer. Creating easily understandable standards for customer communications can go a long way in preventing a phishing attack and recovering quickly from one.
E-mail is currently the largest attack vector for phishing malware and ID theft exploits. This may change, as Web sites increasingly begin to employ advanced scripting techniques and automated functions; but e-mail is still the hands down winner.
You can take a number of steps to protect your business from fraudulent e-mail, including the following:
- Standardizing your communications with the customer
- Implementing e-mail authentication
The following sections discuss these topics in more detail.
Standard customer communication policy
Even if you're not a financial institution, as an ISP or Internet company you should have a customer e-mail policy. Policy is one of those terms that can mean several things. For example, there are security policies on firewalls, which refer to the access control and routing list information. Standards, procedures and guidelines are also referred to as policies in the larger sense of a global information security policy. For example, a policy can provide protection from liability due to an employee's actions, or it can control access to trade secrets.
Companies need many types of policies, standards, guidelines and procedures. But what I'm talking about here is creating a standard for e-mails from the company to the customer, which doesn't use the types of phish hooks you see in a phishing e-mail. A standard customer communications policy should convey a consistent message and not confuse your customer.
Here are some basic customer e-mail policy standards:
- Don't send e-mail in HTML format.
- Don't send attachments.
- Don't include or ask for personal information.
- Use the full name of the user.
- Don't include hyperlinks.
- Use localized messages.
Read Chapter 6, Helping Your Organization Avoid Phishing.