Preventing Phishing Attacks

Preventing phishing attacks entirely is not a realistic goal. Enough messages arrive, and enough of them are good, that somebody eventually clicks.

The useful question is what happens next, and the answer is mostly technical.

Multi-factor authentication is the single largest control, because a captured password on its own stops being enough. Blocking or clearly marking external mail helps people spot impersonation. A verification step for payment or bank detail changes, using a known phone number rather than details in the email, stops the most expensive category outright.

Awareness training still matters, and it works considerably better as the second layer rather than the first. Controls that do not depend on anyone being alert on a bad day are what keep a click from becoming an incident.

The Australian Cyber Security Centre publishes control guidance. This is general information rather than legal advice, and obligations vary by state and territory.

See Sentrient’s cyber security training course and cyber security policy template.