A lot of you would have recently received emails looking as if they arrive from someone you know, inviting you to open a link or a document attached. However, if you check the email address usually looks something like that:

Someone You Know <very_unusual_email@very_strange_domain.com>

This method is called spoofing and happens a lot recently. Individual pretend to send email from someone you know to trick you to send or share information. There has been a lot of reports of money transfers as well as system compromises.

When you receive emails always make sure that you confirmed where the email came from, and if the request is outside of the usual behaviour make sure that you call the person to validate the requests.

The SPAM and security systems are always playing catch-up and we should see fewer emails like that making their way into your mailbox, but that shouldn’t prevent you from validating requests.

Recently there has been an anecdote online, which is not far off from reality in a lot of places:

To increase security awareness, we send emails to our users & tell them not to share passwords, 2FA/ssh keys etc. We tell them no one from IT would ask for your password or other sensitive stuff.

So far, 10 people shared their passwords and ssh keys by replying to that email.

We can have the best protection in place, firewalls, spam blockers, but mitigating phishing, spoofing, pretexting and other social attacks are hard due to human factors.

Training is one thing that helps, but everyone needs to stay alert.

That’s why it’s critical for ongoing training, it’s not a one-off event. Any business needs to continually reevaluate as well as educate your employees and users.

At Deployflow we work with a number of businesses and helping them understand technical challenges, and helping educate the users. Why don’t you get in touch with our team to see how we could help your organisation improve your security posture.