ASHRAE Journal - February 2023 - 22

COLUMN CYBERSECURITY
taken by the user since the redirection takes place
outside of their network.
How to Protect Yourself From Phishing
As with most aspects of security, protecting yourself
from phishing requires a low level of constant vigilance.
Methods to recognize phishing attempts should be
included in company-provided cybersecurity training.
Many phishing attacks are relatively easy to spot if you
know what to look for. Clues that a message might be a
phishing attack include:
* Misspellings, grammar, or punctuation errors.
An email that purports to be official correspondence
from a legitimate company should have none of these
problems. Personal correspondence may not have this
expectation.
* Uses generic email instead of a company
email address. A message from an address such as
YourCompanyCEO@gmail.com is very suspicious.
* False sense of urgency, possibly through a threat or
expiring offer. They are trying to get you to act without
thinking.
* Requests personal information, such as an account
number, password or financial data. This type of information
should never be legitimately requested by email.
* Be careful with attachments, links and remote
content. Attackers may send an infected file or malware
as an attachment. The name of the file may be designed
to make you think it's safe when it's not ( " PLEASE_OPEN.
DOC.exe " ). Links may also be designed to deceive. The
text of the link may show the URL for one website but
take you to another. You can check the actual destinaTop
Level Domains
T
he top level domain (TLD) is the last part of the website
name. A few are widely used, such as .com, .org, .net,
.edu, and .gov. There is also a TLD for every country, such as
.us for the USA or .ca for Canada. There were 1,4873 unique
TLDs in use when this column was written.3 It is unlikely
that any company has registered their name in all of them.
Criminals frequently register domain names anonymously and
use those domains for phishing, distributing malware or other
illegal activity. If an email is from or directs you to an address
that looks suspicious, don't trust it. Following links to http://
ASHRAE.VACATIONS will not lead to any relaxation.
22
ASHRAE JOURNAL ashrae.o rg
F E B R U A RY 2023
tion by hovering your mouse cursor over the link. The
actual destination will be shown in a pop-up window
or at the bottom of the email application window. Some
phishing attacks can be launched just by loading remote
content, such as pictures in an email. If you don't trust
the sender, then don't download attachments or load
remote content.
* Uses a misspelled or unusual domain name, i.e.,
AHSRAE.org (note the swapped letters), or from an unusual
Top Level Domain.
If you find any of these indicators in a message, take a
minute and look for more. Many phishing attempts will
be obvious if carefully examined. It is also important to
check that your outgoing email does not exhibit any of
these characteristics, so it is not mislabeled as spam or a
phishing attack by the recipients.
What to Do if You Are Phished
Don't panic! Also, don't click on anything in the message,
don't let your email viewer load remote content or
pictures and don't download any attachments. If a message
looks suspicious, forward it to your IT department
if you have one and then delete it. Many companies have
established IT procedures that you should follow above
all other advice.
If you clicked on an attachment or link and think
your computer has been infected, you should
immediately contain the infection by disconnecting
your computer from the network4 and informing
your IT department or specialist. If possible, put it in
hibernation mode. Do not shut down the computer,
as a virus or malware may have more opportunities
to damage your system when it restarts.5 Your IT
specialists should have the knowledge and tools to
inspect and clean your system safely.
References
1. CyberTalk.org. 2022. " Top 15 Phishing Attack Statistics (And
They Might Scare You). " CyberTalk.org. https://tinyurl.com/
bdwhj646
2. IBM. 2022. " Cost of a Data Breach 2022: A Million-Dollar
Race to Detect and Respond. " IBM. https://tinyurl.com/yc5arrum
3. IANA. Undated. " TLDS Alpha by Domain. " IANA. https://data.
iana.org/TLD/tlds-alpha-by-domain.txt
4. NIST. 2013. " Guide to Malware Incident Prevention and
Handling for Desktops and Laptops. " NIST SP800-83 R1. National
Institute of Standards and Technology.
5. Cimpanu, C. 2019. " Experts: Don't Reboot Your Computer
After You've Been Infected With Ransomware. " ZDNET.com.
https://tinyurl.com/2p8byp64

http://www.AHSRAE.org http://www.CyberTalk.org https://tinyurl.com/bdwhj646 http://www.CyberTalk.org https://tinyurl.com/bdwhj646 https://tinyurl.com/yc5arrum https://data.iana.org/TLD/tlds-alpha-by-domain.txt https://data.iana.org/TLD/tlds-alpha-by-domain.txt http://ashrae.vacations http://ashrae.vacations http://www.ZDNET.com https://tinyurl.com/2p8byp64 http://ashrae.org

ASHRAE Journal - February 2023

Table of Contents for the Digital Edition of ASHRAE Journal - February 2023