How do you reduce the phishing risks of social engineering?

Answer 1

To reduce the phishing risks of social engineering, organizations and individuals should focus on awareness and layered defense. Regular security training helps employees recognize suspicious emails, links, and messages. Implementing multi-factor authentication adds an extra barrier against unauthorized access. Use advanced email filters and anti-phishing tools to detect and block malicious content. Keep software and browsers updated to patch vulnerabilities. Encourage a “verify before you trust” approach—always confirm unexpected requests through official channels before taking any action.

Answer 2

As with nearly all social engineering, the best way to reduce the risk of phishing is education, policies and procedures. Some key elements are:

1) Recognize all types of phishing emails. Many phishing emails will be address to a generic "customer" or "sir or ma'am" instead of directed to the customer by name.

2) Do not send personal information via email. There are almost always more secure ways to provide that information to a legitimate entity.

3) Confirm the identity of the sender via another method. Look up the company name and call them about the email for example. Call the number on your bill.

4) Confirm the site you send personal email to is secure before entering the information. Usually the address will start with https:// instead of just http:// and the "lock" icon should be displayed on the browser status bar

5) Do not click on links in email you receive from people you do not know

6) Resist clicking on links in email from people you DO know until you have confirmed the source of the email.

7) Use a "throw away" email address for sites that request an email address. A throw away email address will receive the spam and phishing requests and you never bother to look at it so you never get suckered by what is sent to it.

8) Never use the same password for every site that you have access to. This way if someone manages to get you to divulge the password to one site, they won't have your password to the other sites you use.

9) At no time should you ever supply your ID or password to anyone when you have received an email requesting that you do so. Certainly any reputable site such as eBay, PayPal or the bank or Credit Card Company that you deal with online will not request this kind of information from you.

There are also measures businesses can take to help protect their customers from phishing attacks such as monitoring new and existing domain registrations for addresses similar to their own legitimate site and educating their customers about phishing.

These are certainly not ALL the means to reduce the risks of phishing, but they are a good start.