• 27 November 2024, 07:22 AM

Opening Hours

Mon-Fri:08:30 AM To 6:00 PM

Email Support

support@dsmgroup.co.uk

Head Office

The Old Hangar, Peterborough PE8 6NE

Tag Archives: phishing

  HomeDSM Group   : :   phishing
man in the middle
Posted on By Author DSM Group Categories blog, Cyber Security

What is a Man-in-the-Middle Attack and How Can You Prevent It?

 

This type of cyber crime is very common and on the rise, so here’s what you need to know about MITM attacks, including how to defend yourself and your business against them.

What is a man in the middle attack?
The idea behind a man-in-the-middle attack is straight forward: Intercept traffic coming from one computer and send it to the original recipient without them knowing someone has viewed, and potentially altered, their traffic.
MITM attacks give the perpetrator the capability to steal funds, redirect a browser to a malicious website, or steal information to be used in later cyber crimes.

These are three popular types of MITM attacks your business will most likely encounter:

1. Email Hijacking
Hackers target and gain access to important email accounts, they will then monitor activity and transactions to make their eventual attack a lot more convincing. For example, they could wait for a scenario where the customer is sending money and respond, spoofing the company’s email address, with their own bank details instead of the company’s. Unfortunately, the customer thinks they’re sending their payment to the company, but they’re really sending it right to the hacker.

2. Wi-Fi Eavesdropping
Most MITM attacks rely on Wi-Fi connections. Hackers will set up a Wi-Fi connection with a legitimate-sounding name and all the hacker has to do is wait for you to connect and they’ll instantly have access to your device. Alternatively, the hacker can create a fake Wi-Fi device disguised as a legitimate Wi-Fi access point to steal the personal information of everyone who connects.

3. Session Hijacking
When you log into a website, a connection between your computer and the website is established. A hacker will then hijack your session with the website through various ways. One option they use is stealing your browser cookies. Your cookies store small pieces of information that makes web browsing convenient. It can be your online activity, login credentials, pre-fill forms, and in some cases, your location. If hackers get hold of your login cookies, they can log into your accounts and assume your identity.

“Who is the typical target of a man in the middle attack?”

Any person or any business could be the target of a MITM attack.

How do I prevent man-in-the-middle attacks?
There’s no simple ‘quick fix’ to protect yourself against MITM attacks, however here are a few to help you:

  1. Only connect known, trusted devices to your Wi-Fi networks. Don’t allow devices to automatically connect.
  2. Make sure all access points are secured and encrypted. Attackers that rely on physical proximity can be kept off a network by good security.
  3. Keep an eye out for phishing emails that request you to click to log in to a website.
  4. Train your staff to become a ‘Human Firewall’
  5. Make sure operating systems are patched and updated to prevent attacks that exploit weaknesses.

How would your business stand up against a Cyber attack?

The Case for a Cloud Email Security Supplement
Posted on By Author DSM Group Categories blog, Email Security

Top 10 Email Security Tips

Email security involves using different tools and tactics to help identify and filter out potential harms and attacks. Without protection, emails are essentially open and free for hackers and other malicious users to snoop and poke around in. While the best way to ensure email security is to enlist the help of a full stack security service, users can help improve their protection by following these email security tips.

Understand Cyber Crime

Cyber crime comes in many shapes and forms, ranging from harmless pranks to company bankrupting crime. BEC (business email compromise) attacks should be considered one of the biggest threats to businesses today. They have cause billions in company losses and continue to evolve and multiply at an alarming rate.
The first step in defense against cyber criminals, is a clear understanding of the various types of malware, ransomware, viruses, and phishing attacks. Each of these target a specific type of user and require different precautions to be taken to avoid infection.

Use a Strong Password

As far as email security tips go, password creation and security have always dominated the conversation, for good reason. The importance of a strong account password can not be understated when talking about email security. Passwords should always be over eight characters, include of mix of lowercase and capital letters and number, and never be easy to guess (i.e. town of birth, pet’s name, favorite band).
For further protection, users can implement a password management system, such as KeePass, or enable 2-factor verification.
Control Who Has Your Email
Email addresses are used for almost everything on the web now, but that doesn’t mean user’s should just hand theirs over. The more public an email address is, the more likely it is to be targeted for an attack by hackers. User email addresses are also exposed to attacks through the email lists that are collected and compiled by companies and businesses. This leaves the security of the user’s email address to the company, which may or may not be completely secure.

Protect Your Sent Emails

The path email takes when sent, is not direct, the email will go through 3rd party servers on it’s way to it’s destination. Anyone along this route is able to look at or edit the original email without the sender’s knowledge and can lead to serious data and information breaches.
To protect against unwanted snoopers, users can use a range of tactics and email security tips. One of the most applied method is the enabling of TLS encryption. TLS adds an additional layer of protection to email and stops hackers from being able to read the content of the email. If TLS can not be enabled, or the destination server doesn’t have TLS enabled, emails will continue to be unsecured and the user should be cautious.
In general, user’s should protect their email attachments with passwords or by placing them in a zip file. This ensures the user’s files can not be tampered with or infected on the path to it’s destination regardless of if TLS is enabled.

Enlist an Email Security Service

Email security is nothing to take lightly, especially when the number and sophistication of these cyber attacks are increasing. Email security companies use filters and other tools to help sift through email looking for spam and potential attacks.
The biggest advantage of enlisting an email security solution is the ability to combat both known and unknown attacks. Security software, such as antivirus, use data from previous versions attack to identify and defend against it; they can not identify or stop new attacks.

Know What Your Opening

The majority of cyber attacks happen through email as it is the easiest way onto a user’s computer. Proper education and training should be completed by anyone who interacts with email on a regular basis. Hacker tactics are getting more advanced and authentic looking by the moment, so user’s should always be aware of how to detect a malicious email and what to do if they receive one/open one by accident.

Be Wary of Public Connections

One of the lesser known email security tips is to avoid the use of public devices and connections. Public computers and hot spots can be tempting for those users on-the-go, but their unsecured nature makes them a hotbed for cyber attacks.
When a user logs onto a public computer they are completely unaware of who and what has been on that device in the past. While the machine may appear normal to a user, there could be unsavory programs installed such as keyboard logger, waiting to collect credentials.
Hackers use public hot spots as a way to lure in unaware victims, once connected, these victim’s computers become completely accessible. Once they have access, the hacker can view the computer’s information, lead the user to phishing sites, or trick them into downloading malware or ransomware.
The best way to stay safe in public is to avoid open connections and shared computers.

Restrict What You Put Online

Social media is one of a cyber criminals favorite hacking tools. Hackers research social media accounts get vital personal information directly from profiles and self written bios. This information helps hackers to bypass the account security questions like “what is your mother’s maiden name,” used by official institutions, banks, and government agencies.
It may be impossible to protect all personal information while online, but users should still be careful about what information they share.

Back Up Your Information Regularly

One of the greatest email security tips a user can receive is to frequently back up their data.
Ransomware attacks are becoming more and more popular, mostly due to the high ROI the attack awards the hacker. Once installed, these attacks start by scanning through the user’s computer, selecting files and encoding them. When encryption is complete, the user is notified that their files are being held for ransom and the user must pay a fee to get the key.
This type of attack can be severely detrimental to a user, leaving them with nothing more than shell of a computer. After the files are encoded, user’s are left with an option to pay the ransom or to lose all their data, which may not be possibility for a user/company.
Backing up information on a consistent basis is the best and easiest way to protect oneself from a ransomware attack. Since the user will already have a backed up version of their information, there will be no need to stress over the encryption or pay the ransom.

Stay Safe on Mobile

Although not publicised as much as desktops, mobile phones can and do, still get attacked. A user’s phone is not only vulnerable through email and phishing sites, user’s must also be wary of the apps they are downloading. While Android devices are more likely to be attacked, iPhone users should also be cautious to ensure safety. Be sure not to visit any potentially dangerous sites or download any unknown attachments with out putting in place other security strategies.