Beware “Phishy” Emails
By Wassef Masri
When the accounting manager at a major retail US company received an email from HR regarding harassment training, he trustingly clicked on the link. Had he looked closer, he could’ve caught that the source was only a look-alike address. Consequently, he was spear-phished.
The hackers emailed all company clients and informed them of a banking account change. The emails were then deleted from the “sent” folder. By the time the scam was discovered a month later, $5.1 Million were stolen.
As in the previous crisis of 2008, cyber-crime is on the rise. This time however, hackers are higher in numbers and more refined in techniques. Notably, the emergence of malware-as-a-service offerings on the dark web is giving rise to a class of non-technical hackers who are better at marketing and social engineering skills.
Phishing emails are the most common attack vector and are often the first stage of a multi-stage attack. Most organizations today experience at least one attack a month.
What started as “simple” phishing that fakes banking emails has evolved into three types of attacks that increase in sophistication:
- Mass phishing: Starts with a general address (e.g. “Dear customer”) and impersonates a known brand to steal personal information such as credit card credentials.
Spear phishing: More customized than mass phishing and addresses the target by his/her name, also through spoofed emails and sites.
- Business Email Compromise (BEC): Aka CEO fraud, is more advanced because it is sent from compromised email accounts, making them harder to uncover. They mostly target company funds.
How to Protect Against Phishing?
While there is no magical solution, best practices are multi-level combining advanced technologies with user education:
1. User awareness: Frequent testing campaigns and training.
2. Configuration of email system to highlight emails that originate from outside of the organization
3. Secure email gateway that blocks malicious emails or URL’s. It includes:
- Anti-spam
- IP reputation filtering
- Sender authentication
- Sandboxing
- Malicious URL blocking
4. Endpoint security: The last line of defense; if the user does click a malicious link or attachment, a good endpoint solution has:
- Deep learning: blocks new unknown threats
- Anti-exploit: stops attackers from exploiting software vulnerabilities
- Anti-ransomware: stops unauthorized encryption of company resources
It is not easy to justify extra spending especially with the decrease in IT budgets projected for 2020. It is essential however to have a clear strategy to prioritize action and to involve organization leadership in mitigating the pending threats.
Leave a comment or send an email to wmasri@newtheme.jlizardo.com for any questions you might have!
