Friends,
The American Government has known about the Chinese Army (PLA) attacking Americans for ten years. Now we are supposed to panic.
OK. What do you do?
Well, you could place your computer on the top-secret American Government internet.
Wait. They won’t let you and I do that. They spent all that money only to protect them, not to protect us. Instead government wants more money to give people on welfare iPhones.
OK. I can repeat what you already know.
What can I do.
What can you do?
First, get a good anti-virus. Get a good firewall.
And keep your operating system updated. Keep your software updated.
What else do you do, that I and others should do?
Ghost.
A multilayered security solution is always a good option. Utilizing a properly configured firewall, antivirus, and frequent updates are obviously important, but I believe that a good training program is equally as important.
Educate your users against the dangers of phishing and other social engineering attacks. These attacks are far more dangerous, because they exploit the human element, which is prone to mistakes. A successful social engineering attack will completely bypass every single one of your software security solutions.
Check out my blog to read more on this subject!
http://www.blackbox-security.net
Seth,
Great comments.
Do you think we can protect the human element?
ghost.
Commenting on your post actually inspired me to write a post of my own. You can read it here:
http://www.blackbox-security.net/security-what-do-you-need/
I like it!
To directly answer your question, training your users (or you specifically) on the methods that social engineering attacks utilize will limit the effect that they have on you. Some phishing emails or websites can be VERY convincing.
Practice makes perfect, and you can practice your security “senses” by using a service called PhishGuru, by Wombat Security.
Link:
http://www.wombatsecurity.com/phishguru
Thanks!
Sorry to blow up your post, I just remembered another resource you can use to familiarize yourself with phishing scams: http://www.phishtank.com/