PHISHING AND SPAM

INTRODUCTION There’s a good chance that in the past week you have received at least one that pretends to be from your bank, a vendor, or other online site. Hopefully, you have realized that many of these s are not what they proclaim to be – they are not legitimate s, but “phishing.” 2014 DHS IT Security & Privacy Training 2

INTRODUCTION In other words, the sender of the s (phisher) wants you to click on a link in the and go to a fake website which you may think is the legitimate website. On the phishers’ website, they hope to obtain your user account and passwords, financial, credit, and/or identity information. They do this by asking you to enter passwords or other identifying information that unlocks your information; They do this by recording your keystrokes while you are visiting their website; and They do this by surreptitiously downloading malware on your computer while you are on their website DHS IT Security & Privacy Training 3

SOCIAL ENGINEERING “Phishing” is one form of social engineering. Social engineering is the practice of deceiving someone, either in person, over the phone, or using a computer, with the express intent of breaching some level of security, either personal or professional. Social engineering techniques are considered con games which are performed by con artists. The targets of social engineering may never realize they have been victimized DHS IT Security & Privacy Training 4

PHISHING Phishing uses messages that supposedly come from legitimate businesses you might have dealings with: Banks such as Bank of America or Citibank; Online organizations such as eBay or PayPal; Internet service providers such as AOL, MSN, or Yahoo; Online retailers such as Best Buy; and insurance agencies. The messages may look quite authentic, featuring corporate logos and formats similar to the ones used for legitimate messages DHS IT Security & Privacy Training 5

PHISHING Typically, phishers ask for verification of certain information, such as account numbers and passwords, allegedly for auditing purposes. Identity theft is the name of the game. And because these s look so official, up to 20% of unsuspecting recipients may respond to them, resulting in financial losses, identity theft and other fraudulent activity DHS IT Security & Privacy Training 6

HOW DO YOU KNOW IF IT'S REAL OR FAKE? 2014 DHS IT Security & Privacy Training 7 Fake  Often contains a generic greeting (it does not call you by name, but as “customer,” “friend,” etc.).  Often claims your personal information has been corrupted, lost, or has expired.  Directs you to a real-looking but counterfeit web site. Almost every company that has your personal information will have a policy that forbids the company from sending attachments or pop-up windows asking for personal information from you and its other customers.

WHAT TO DO WITH A SUSPECT DHS IT Security & Privacy Training 8 If you get an requesting private information:  Verify it really came from where it says before giving out any information.  Call the sender and verify the is authentic.  Delete the . If it is important, the sender will send it again.

SPAM V PHISHING Not every junk or spam is a phishing . The word "Spam" as applied to means "Unsolicited Bulk ". Unsolicited means the recipient has not granted permission for the message to be sent. Bulk means that the message is sent as part of a larger collection of messages, all having essentially identical content. A message is spam only if it is both unsolicited and bulk. Unsolicited is normal such as first contact enquiries, job enquiries, sales enquiries, etc. Bulk is normal such as subscriber newsletters, customer communications, discussion lists DHS IT Security & Privacy Training 9

SPAM V PHISHING So, spam is unsolicited , usually from someone trying to sell something. The difference between spam and phishing s is that spammers do not attempt to acquire sensitive information DHS IT Security & Privacy Training 10

WHAT TO DO WITH SPAM If you use , you will get spam on your computer. DHS uses a spam filter called the User Quarantine Release that uses a formula to identify suspected of being spam and filters it out DHS IT Security & Privacy Training 11

USING THE USER QUARANTINE RELEASE The User Quarantine Release (UQR) is the DHS Outlook spam filter. It collects suspected to be spam. That does not go to your Outlook inbox. You will receive an auto-generated once a day or on days you have suspect notifying you of any message addressed to you that was quarantined because the system determined it might be spam. From within this notification, you may release messages that you believe are valid s. The UQR deletes the it holds after a 7 days. The next slide gives an example of what the UQR looks like DHS IT Security & Privacy Training 12

USING THE USER QUARANTINE RELEASE 2014 DHS IT Security & Privacy Training 13 Click here to approve or release .

WHAT TO DO WITH SPAM The best way to deal with spam is to delete it. You need to file a Security Incident Report for spam only if your DHS computer is being overrun by spam not being caught by the UQR. Receiving an occasional spam in your inbox does not need to be reported DHS IT Security & Privacy Training 14

DHS POLICY USAGE 2014 DHS IT Security & Privacy Training 15 A User:  Accepts responsibility for any created by that user, and for revisions in messages that are forwarded or replied to.  Accepts responsibility for any he or she stores or saves.  Does not have responsibility for messages received but not created by the user as long as those messages are deleted, not stored, from the user’s mailbox. These are the primary guidelines of the policy:

DHS POLICY USAGE 2014 DHS IT Security & Privacy Training 16  Inappropriately modifying an message or printing inappropriate has negative consequences.  Evidence of misuse of the system may result in termination of access to the DHS network without notice.  DHS cannot guarantee protection from containing viruses, worms, or malicious attachments. Suspicious should be reported on the IT Security Incident Report form.