1. Phishing/smishing attacks-Email and text scams (aka phishing) are especially prevalent during tax season. If you receive an email from the “IRS” or state tax agency with information about your refund, be mindful that this is most likely a phishing scam. The IRS will never initiate contact with you via email regarding a bill or tax refund.

There has also been an exponential increase in what’s known as “smishing” as of late. Smishing (SMS + phishing) is essentially phishing using text messages instead of email. Hackers will pose as someone from an organization you recognize (trusted companies, government agencies, charities, IRS and Treasury department) and request personal information from you via text message.

Prevention tip: Remember, the IRS does not send emails or text messages asking for personal information or account numbers. If you receive communication from the “IRS” via email, phone, social media or text, it is a scam! Do not open any links or call numbers in these messages. If the IRS needs to contact you, they will usually send a message through the mail.

Also, regardless of the source, it is always prudent to contact the individual reaching out to you by phone to confirm the nature of the email content

2. Ransomware- Ransomware is a form of malware (malicious software) that encrypts a victim’s files so they cannot access files, databases or applications. To restore access, the attacker will demand a ransom from the victim, which can range from a few hundred dollars to thousands, payable to cybercriminals in Bitcoin.

Prevention tip: Make sure you maintain current patching of all systems – most malware deposits do not occur in “Zero Day” attacks. Also, implement Multifactor Authentication and endpoint detection and response services. Backups should be performed and tested regularly as part of your overall Incident Response Plan.

Finally, consider segmenting your systems to mitigate the impact of ransomware across the environment.

3. Man-in-the-Middle- This scam involves a person who acts as a middleman between two near field communication (NFC) devices and receives and alters the data as it passes between them.

Prevention tip: Devices should be in an “active-passive pairing”. In other words, one device should be receiving information and the other should be sending it, rather than both devices sending and receiving.

4. SQL Injection- Through an SQL injection, attackers are able to inject malicious SQL code into an application to view a database and make modifications to it. This can result in sensitive company data being exposed and users’ data being compromised.

Prevention tip: Make sure to stay current on software updates, don’t share database accounts across applications and follow proper security measures. If you perform software development, make sure regular testing of your application code occurs as part of the system development cycle.

Regularly perform vulnerability testing and external penetration testing of your environment and remediate issues immediately upon discovery.

Read more in part two, where we explore denial-of-service attacks, DNS spoofing, cross-site scripting and zero-day exploits.

Questions? Contact us.