Why you still need to know how to scan links for viruses

Hopefully, by this point, all businesses have grasped the fact that they need robust anti-malware protection and a firewall on both their website and their local devices (including mobile ones). These offer significant protection, but, all the same, it is still very useful for human staff to know how to protect themselves online, especially how to scan links for viruses as this allows them to act as backstops for your security software.

Why you still need to know how to scan links for viruses

If you’re using a robust security product then there is a very good chance that you can depend on it completely for protection. This is not, however, 100% guaranteed as malicious actors are continually changing their tactics. For this reason, the safest option is to teach human staff how to protect themselves when using email and the internet. In particular, it’s important to teach them how to scan links for viruses.

How to check links for viruses

Firstly, look for any strange characters. People with legitimate domains generally want them to be easy to remember. They are therefore highly unlikely to want to use domains with strange characters in them. This means that strange characters in links are likely to be a sign that the sender is using URL encoding to disguise the fact that a link is malicious.

Secondly, never click an embedded link in an email (at least not without verifying it). An embedded link is one that has the real link hidden behind regular text. These are widely used on webpages as they make them look tidy and therefore easy to read. By contrast, they are hardly ever used in legitimate emails as they have become so strongly linked with phishing attacks.

In short, an attacker presents themselves as representing a legitimate organization, such as a bank, and, in that capacity, instructs the recipient to click on a link to take an action, such as logging in. In most cases, you don’t even need to bother scanning this link for viruses, just assume it is a phishing email and delete it. If you do want to check just go to the organization’s real website and log in from there.

If you do want to check it, then the easiest option is just to right-click on the embedded link and choose “view properties” and you’ll be able to see the actual link behind it. Depending on how astute the hacker has been, this may look a bit like the genuine URL, but if you look at it properly it will probably be fairly obvious that it’s false.

Thirdly, be alert to short links. Rather like embedded links, these do have legitimate uses especially on social media where you can’t embed links as you can on webpages. In emails, however, they are a major security risk. If you’re interested in them, you can use a link expansion service to check the proper link, but, usually, the safest and most time-efficient option is just to delete them.

Remember text messages can have links too

Although everything in this article so far has referenced email, text messages can have links too. In a business context, it’s less likely that people will receive malicious links through text messages than that they will receive them through email. This is purely because fewer people have company phones than company email addresses. That said, if you are using company phones, then you need to apply the same security practices to text messages as you do to emails.

You also need to make sure that all mobile devices, especially cellphones, have at least the same level of protection as regular computers. Remember that teaching humans how to scan links for viruses is essentially a backup to your automated protection. It’s highly unlikely to be enough on its own.

It’s vital to teach staff how to stay safe on the phone

Although it’s still very common for malicious actors to use old-school “spray and pray” tactics to spread their malware, it’s becoming increasingly common for attacks to be targeted. This is particularly true of attacks where there is, or at least can be, a direct economic benefit to the attacker, such as ransomware attacks.

These targeted attacks can be very sophisticated and involve a lot of preparatory work to gain the victim’s trust. This can involve emails and instant messages but it can also involve phone calls as it is much harder to monitor these in real-time and alert people to threats. It’s therefore vital that you teach staff how to monitor their own security on calls, especially video calls.

Please click here now to have your website scanned, for free, by cWatch from Comodo.