1. Monitor Websites, Social Media, and AdvertisingPhishing attacks start with stealing your corporate identity. They establish websites that look identical to your own, place nearly identical ads in your name, and create near carbon-copy social media accounts that are complete with pages and posts. They’ll send e-mails that duplicate your logo and letterhead, or tweets from a Twitter handle that changes only one inconspicuous letter from your own. Some scammers have even been found impersonating CEO’s and other members of a company’s leadership team. Their goal is simple: To free-ride off your corporate reputation. A phisher wants to mimic a website so trustworthy that users won’t think twice before plugging in their financial information. Arguably that trust is, in fact, the first thing they steal. The good news is that you know what to look for. Constantly monitor your online environment both inside the firewall (within your network) and outside of it (on the internet at large). Use tools that search the web for your logo and other copyrights, as well as find social media accounts using names similar to yours. Have your e-mail server check for any inbound messages containing your branded content. Phishers depend on this material to duplicate your company’s look and feel, and the right tools can help you spot it even on the deep web. Let scammers know that no matter how many fake websites they put up and no matter how many social media channels they hijack, you will take them down as soon as they are published. Soon enough they’ll give up, realizing that it isn’t worth the cost to phish someone as aware and dedicated to fighting scams as you are.
2. Guard Your DataSometimes security starts at home. Your company stores a wealth of data that could be used to compromise its followers. From email addresses to personal information and financial records, your servers hold everything a phisher needs to make the scam look real. Protect your community by protecting yourself. Establish well-known methods of communication, whether via e-mail, social media, or even snail mail. Make sure everyone in touch with your company knows exactly how they’ll hear from you. Never deviate from this process and let everyone know that non-compliant communication should be treated as illegitimate. It is important to then secure that point of contact. Protect your network with strong, preferably two-factor, authentication. You might have your financial records under lock and key, but how secure is your e-mail server? Does your social media team understand the need to protect their Twitter and Facebook credentials? Exactly how many people can post on your Slack? The same thing goes for personal data. People often use proprietary e-mail addresses or high-privacy accounts when it comes to financial contacts, such as blockchain firms. For them, the mere fact that a scammer knows how to reach them will give the attack legitimacy. Double check all of these details and educate your team on security. After all, the only thing worse than a scammer creating fake accounts is one who can use the real thing.
3. Respond QuicklyThere are a number of things you need to do after discovering that scammers have launched a phishing attack in your name, and all of them have to happen immediately. Reach out to your community so that they know what is happening. While it’s true that no one wants to publicize an ongoing security issue, it will be far worse if the world reads about it in the press. Leave no ambiguity about the nature of the threat and be clear about how you will follow up. Then, ensure that you do follow up. Identify all relevant hosts, domain registrars, and e-mail services, along with all social media channels. Contact them to try and get the malicious content blocked or taken down. Proactively reach out to all social media channels, even ones where you haven’t identified a threat. Phishing is cross-platform. Just because you haven’t found a threat on Telegram or LinkedIn doesn’t mean it’s not there.
4. Communicate and EducateYour customers can be your first and best line of defense against phishers. Staying engaged with your community isn’t just good business sense, it can also help you catch problems in their infancy. Establish forums, whether through your own website or through social media channels, and get actively engaged in them. Build a reputation for responding promptly to comments, e-mails, and other inquiries. Consider setting a dedicated contact for security issues, and establish regular communication about these matters. Alert your community when you find a phishing site and invite them to do the same in return. Use your web presence to publicize evolving threats, including the growing reach of scams outside traditional social media and into Medium, Google Docs, Telegram, and other platforms previously thought fairly safe. A culture of engagement and education will give your customers the opportunity to help you learn about suspicious behavior out on the web. If it ends with someone forwarding you a suspicious message or asking about an unusual URL, all that effort will be worth it.
5. Enforce, Enforce, Then Enforce Some MoreYou can’t do this alone. Enforcement will play a crucial role in your response to a phishing attack because, make no mistake, even if the scammers haven’t targeted anyone inside your firewall you are under attack. Respond accordingly. Ensure in advance that your company’s legal counsel has the capacity and institutional expertise necessary to respond quickly in case of a digital threat. Discuss with them the risk that phishing poses and emphasize the importance of a quick response to any phishing site or posts detected. When you identify a phishing attack, have them immediately contact relevant 3rd party companies such as domain registrars, advertisers and social media platforms. Attorneys will be crucial to getting offending content removed. While some platforms will work with your firm in good faith, some may not. Others may simply require the paperwork of a takedown letter or subpoena in order to process your request. As part of this process you should make sure that all corporate content is properly protected through appropriate copyright, trademark, and other intellectual property registration. Often a court order or third party compliance will require proof of protected content, so be sure you have that paperwork ready in advance. When good faith efforts aren’t enough, consider contacting law enforcement. Many criminals launch their phishing attacks from third party jurisdictions and bulletproof servers. Government agencies may have the reach and authority to intervene when lawyers and domestic courts can’t. When it comes to phishing attacks don’t pull your punches. Responding with every tool at your disposal and the full force of the law sends a message to future attackers that yours is a company they can't afford to mess with.
Yoav Keren is the Founder and CEO of BrandShield and MyShield with 21 years of experience in financial management and business development. Keren is a current member of the INTA anti-counterfeiting committee. His prior experience includes membership in the ICANN GNSO Council and a position as a Senior Advisor to Minister Haim Ramon, at the Israeli Prime Minister's office. Keren also served as Head of the Technology branch for the Israeli military’s Information Security Department.
Keren holds an MBA jointly issued by Northwestern University’s Kellogg Business School and the Recanati Business School at Tel-Aviv University. He received a Bachelor’s Degree in economics and physics from Tel-Aviv University.There are many ICO drops worth browsing in our airdrop list.