The best form of defence is vigilance, as all too often security controls alone are not enough.
At the very least Ė ALL electronic communications should be treated with caution. Even a message from a trusted friend or colleague may not be from who it purports to be. In a corporate environment, itís important that every employee recognises the part they play in the organisationís security posture as a whole.
If you receive an email attachment that you werenít expecting donít just open it Ė instead check with the sender that they did indeed send it. While it may take an extra 10 seconds, it could save hours or even days if the attachment proves to be malicious.
Everyone should learn how to read URLs to readily identify which are genuine and which arenít as attackers often try to entice victimís to click on a link to a website they control by making it look legitimate.
As an organisation, instead of solely relying on technical controls, spend quality time educating the employee base. And I donít just mean putting up a few posters as these passive techniques, alone, are not enough. You need to take a pro-active approach and immerse people in on the spot training with true-to-life experiences and scenarios. This way user behaviour can be changed and the message is more likely to be remembered.
What is, currently, the magnitude of the phishing threat?
Spear phishing against employees is the number one threat organisations face today. Thatís not just me saying it Ė there are numerous headlines that validate this statement. If you look at all the major breaches organisations have suffered recently, the vast majority can be traced back to a phishing attack Ė RSA, Mitsubishi, the chemical and defence sector, the list goes on. The reason this is the attack vector is because it targets the weakest link in an organisationís security posture Ė a human.
ďA phisher can easily send out millions of emails. Even if it tricks just 1% into clicking the link or divulging personal credentials, thatís quite a lot of hits! When phishers do their homework, and craft legitimate looking emails, the success rates increase.
But when it comes to enterprise grade phishing, itís a different ball game. The attackers know theyíre up against enterprise grade security defences. The first thing they change is keeping the volume of emails low to prevent messages being caught in filters or other technical controls. They will spend time doing their homework and studying the individuals within the organisation, on places like LinkedIn and Facebook and other online forums, to craft a very specific message which is sent to just a handful of people. It takes just one person to respond to the message to give them a foothold in the environment.Ē
A recent report by Trend Micro estimates that 91% of all cyber attacks that classify as advanced persistent threats begin with a spear phishing email.