Combine Tools With Training To Take the Most Proactive Approach to Thwarting Phishing

Google is a huge collector of data. It has so much information that it is incredibly attractive to hackers who like to collect data as well and sell it or do something else with it that may not be preferable to Google or its users. So, Google is constantly working to create tools to help thwart phishing. Phishing is still the top way malicious actors grab our information, so working to stop it is a priority at Google.

In May, Google users were targeted with a scam using Google Docs. Users received messages, in some cases appearing to be from known senders, asking for collaboration on Google Docs. Users, being trusting individuals, clicked a link sent in email thinking they were granting permissions to someone they knew to collaborate a document. What happened was they gave away all the information in their Gmail accounts.

Google responded by getting some its people in the counter-abuse technology department together with experts in other departments and working to resolve the problem. Unfortunately, this is a common routine at Google…because they have so much information that is worth so much to cybercriminals. They are constantly under attack.

What happened when they got this group of people together is that within one day, expanded warnings for anti-phishing were released to Android users. That’s ONE DAY! In addition, there are other tools that Google has created to help combat phishing and they continue to develop others.

They have a Chrome extension called Password Alert that warns users that they may be entering login credentials in an imposters webpage and just recently released tools for businesses to alert administrators when users try to send data outside the organization. They also have anti-ransomware protections, which may come in handy in case WannaCry continues to make the way around the globe.

And the Safe Browsing tool blocks a lot of junk mail. In fact, it keeps as much as 90% of it from reaching users. In addition, there are tools available that notify users that they may be giving their login credentials to bad actors and for webmasters who can be notified when their sites may be being used for something other than what they intend.

While Google makes great effort to create tools that require little user interaction, the key to thwarting phishing really lies with the end users. Training them on how to identify phishing in addition to deploying technological tools is a great proactive combination to protecting everyone from phishing. All of the technology in the world does not replace the human brain. Even if 10% of the attempted phishing emails make it through, that’s a lot of opportunity for someone to click a malicious link and set off the ransomware heard around the world. At that point, the damage is already done.