How to protect your agency from phishing
Connecting state and local government leaders
With a tailored approach, layered defenses and data analysis tools, agencies can reduce their vulnerability to phishing attacks.
Everyone makes mistakes. As we spend an increasingly large percentage of our time online, we’ve become aware of the malicious tactics used to trick us into downloading malware or betraying our credentials. Even as our built-in threat detection improves, we risk letting it run on autopilot. When we’re not paying attention, serious trouble can take us by surprise.
In the wake of a series of ransomware attacks that crippled local governments across the country, IT managers who are looking for ways to better protect employees from phishing attacks have realized that human error can be tricky to reduce and all but impossible to avoid. Email, in particular, is one front where employees tend to let their guard down. But there are steps government IT teams can take to mitigate the possible damage from a phishing attack, protect their critical systems and ensure continuity of service.
Tailor the approach
As organizations push to modernize, they often move pieces of their operations to the cloud, beginning with email. Some teams may assume the baseline protection that cloud service providers supply will filter out dangerous messages, but defense in depth is crucial. An agency’s phishing protection plan must be specific to that agency -- an out-of-the-box solution will never catch everything.
Agencies should survey their current email monitoring tools to understand what needs are being filled and what gaps remain. Then, with a clear understanding of their current position, they can build a roadmap to address specific challenges. Some agencies will need strong restrictions on IP addresses, domains and other identifiers for incoming mail to ensure their highly sensitive data goes uncompromised. Others can make do with less-strict rules. Still others may find their mission hindered by too severe a regulation of email communications. One size does not fit all.
For example, not every agency needs to be laser focused on data-loss protection. Is it a good use of time to worry about advanced malware, or are there more probable threats to the agency’s mission? By getting a grip on current security postures and ongoing needs, agencies can determine whether they simply need to update their current tools or bring on new solutions that offer advanced protection and customizability.
Leverage new tools
Advancements in machine learning make identifying tell-tale characteristics of new attack signatures significantly less resource-intensive. Defining patterns and predicting attacks has never been easier, so for agencies with a clear need, integrating new tools can be well worth the investment.
Using cutting-edge data analysis, modern tools can map standard email activity to create expected behavior profiles, flagging anything that strays from that norm. These tools can objectively evaluate potential threats in ways employees can’t, with a level of scrutiny agencies shouldn’t expect from employees in the first place. Constant vigilance and skepticism take their toll on workers who should be committing their mental energy to the job at hand instead of keeping one eye open for fraudulent emails.
Machine learning combined with the ability to rapidly match incoming mail to known threat signatures gives government a much more holistic and agency-specific solution to phishing prevention than any standard program could provide. Instead of chalking a security breach up to user error, agencies can fine-tune their parameters for filtering email, preventing potentially costly mistakes from being made in the first place.
Layer defenses
Even with the most sophisticated filtering system in place, threats might slip through. That’s why every good security plan is layered. After lowering the possibility that a breach may occur, the next step is to mitigate the potential damage should one come to pass.
Chief security officers should understand where email security protocol fits into their wider security infrastructure and how it can best be leveraged for the deepest possible defense. Broader questions can be more impactful than a fine-tuned email security process. Are critical systems isolated from the network? Are there adequate firewalls in place? Is the agency’s backup strategy up to date and operating at full capacity? Agencies must remember that email protection is only one piece of a larger security solution.
Phishing can seem like an unavoidable operating risk as threats become more sophisticated and targeted each year. But with a little planning and some strategic decision making, agencies can greatly reduce their vulnerability to such attacks, ensuring that their employees are free to advance the agency’s mission.