Phishing, Social Engineering, and Ransomware: Practical Defense

Step 1: Understand how phishing works

Attackers pretend to be someone you trust, such as your bank, your manager, or a delivery company, to make you click a link, open an attachment, or reveal credentials. They create urgency or fear, such as a locked account or an overdue invoice, so you act before thinking. Variants include spear phishing aimed at a specific person, business email compromise that impersonates executives to request payments, smishing by text message, vishing by phone, and QR-code phishing.

Step 2: Learn the red flags

Be suspicious of unexpected messages that demand urgent action, a sender address that does not quite match the real domain, links whose real destination differs from the displayed text, requests for passwords, codes, or payments, and attachments you were not expecting. Hover over links to see where they lead without clicking. When in doubt, go to the website by typing the address yourself or use an app you already have, and verify unusual requests through a separate channel such as a phone number you already know.

Step 3: Respond correctly

Do not click, reply, or open attachments. Report the message using your organization's reporting button or process, since security teams can then protect everyone, and delete it. If you already clicked or entered credentials, change that password immediately, tell your security team or provider, and watch the account for unusual activity. In the United States you can report cyber incidents to CISA at cisa.gov/report; other countries have their own national reporting channels.

Step 4: Apply the core ransomware defenses

CISA's ransomware guidance highlights a consistent set of practices. Keep offline, encrypted backups and test restoring them, because ransomware tries to delete or encrypt backups it can reach. Patch regularly and prioritize internet-facing systems and vulnerabilities known to be exploited. Do not expose remote desktop services to the internet. Require phishing-resistant multi-factor authentication, especially for email and remote access. Filter email, flag external senders, and implement email authentication such as DMARC. Train users to recognize and report suspicious messages, and keep an incident response plan.

Step 5: Build good personal habits

Use a password manager and a unique password for every account, turn on multi-factor authentication or passkeys wherever offered, keep devices and apps updated, and back up important files to a place that is not always connected to your computer. These few habits block a large share of everyday attacks.

Personal security checklist
[ ] Password manager with unique passwords everywhere
[ ] MFA or passkeys on email, banking, and social accounts
[ ] Automatic updates enabled on phone and computer
[ ] Backups: one copy offline or otherwise disconnected
[ ] Know how to report a suspicious email at work