By Carla Roncato, Vice President of Identity at WatchGuard

During the summer months, when employees and customers are away on vacation, things usually slow down for businesses. But it's a busy time for cybercriminals; they often take advantage of minimal staffing levels in companies during the vacation period to launch complex attacks. And with many employees away or working remotely it's important to remember anything connecting to the corporate network is a potential vector for attackers, who can make their way into the network core by first compromising a branch office or an endpoint.

Vacation is also a popular theme for business email compromise (BEC) phishing campaigns. A recent Phishing Defense Center (PDC) report highlights a new campaign in which attackers impersonate a company's Human Resources department, sending misleading emails to unsuspecting employees to open a link that mimics vacation submission requests. However, when they open the phishing page, it asks them to provide their username and password, thus obtaining their credentials. This is just one example of how attackers try to take advantage of employees who may lower their guard while dreaming about time off.

Today I'm sharing five ways to keep your company and employees safe and educated against phishing attacks and prevent them from ruining your summer vacation plans.

1. Ensure employees know how to recognize phishing attempts: In addition to impersonating HR, cybercriminals can impersonate someone outside the office. Suppose attackers have gained access to someone's calendar or email account. In that case, they will know when that person is on vacation and can impersonate them by sending messages to other employees to gain privileged access to the system or extort money. It is essential to check the sender's address and message carefully - verify the domain and be on the lookout for wording that looks strange or requests that are out of the ordinary.


2. Implement multi-factor authentication (MFA): The added layer of MFA verification can prevent attackers from entering your organization's network even if one of your staff members has been the victim of a successful phishing attack. In addition, solutions that consider the mobile device's DNA can prevent attackers that attempt to clone a user's device from gaining access to the system, as the DNA of the device would not match.


3. Provide security training for your employees before vacation: Schedule courses to refresh or update employees on your organization's security policies and familiarize them with the best cybersecurity practices when they are out of the office. In addition, since 55% of employees admit to relying exclusively on their mobile devices on days off it increases the odds they will be exposed to another risk, smishing (or SMS phishing), which means it's essential to establish safe mobile working practices.


4. Use endpoint security: An advanced detection and response solution - capable of continuously monitoring endpoints and enabling automated blocking of anomalous user, machine and process behavior -  ensures that network devices are protected in the event of a cybercriminal gaining access to the company's system as a result of a successful phishing attack.
   


5. Draw up contingency plans: Planning in advance ensures your organization can react quickly and efficiently in the event of an attack, limiting its impact and scope. These plans should include a breakdown of who should be involved and their responsibilities, outlining scenarios for team members' vacations. 
   

As always, security starts with individual employees. If you receive a suspicious email about an urgent password change, a payment to a supplier that can't wait, or anything else strange and suspicious, beware! Even if it comes from a known contact, it could be phishing. Verify the sender's address and, if in doubt, do not open or reply to the message. If you absolutely feel you must visit a site you learn about in an email, it's safer to manually enter the domain and find the content you want rather than clicking the link in the email.

Now remember, sunburn isn't the only thing you need protection from this summer. By understanding the above five practices and implementing the necessary technology, businesses can take a sigh of relief over the summer and employees can enjoy their vacations, with the knowledge that they are protected against phishing and attempted cyberattacks.

##

ABOUT THE AUTHOR

Carla Roncato is WatchGuard's Vice President of Identity. She is an industry expert in identity management, access management, open identity standards, data security, privacy, and zero-trust initiatives.  

Carla has expertise in cloud, software, hardware, and services and previously worked at organizations such as Cognizant, Intel, McAfee, Microsoft, Teradata and the OpenID Foundation, where she is an evangelist for open identity standards. She has been featured in the Wall Street Journal, SC Magazine, TechTarget, and Biometric Update media publications.