Laneden - A Cyber-Security Company | Penetration Testing Services | Social Engineering Security Services | Ethical Hacking Services

Phishing emails are generally sent to a large number of individuals simultaneously in an attempt to either make monetary gains or gather or "fish" sensitive information such as credentials, personally identifiable information and payment details. The cybercriminals tend to pose as a reputable source such as a supplier, colleague or some other trusted third party.

The emails often come fully loaded with legitimate-looking logos, signatures and contact details. Common examples of monetary gain emails seemingly come from banks, payment service providers such as PayPal, couriers such as DHL, Royal Mail, DPD etc., credit card providers, eBay and CEO Fraud.

CEO Fraud is a scam in which cybercriminals spoof or take control of corporate email accounts and impersonate executives to try and fool unsuspecting employees into making payments or sending other confidential information to the attackers.

According to Action Fraud, the largest payment made to fraudsters was £18.5 million; however, the average loss is £35,000. Out of the £32 million reported losses since 2015, only a total of £1 million has been successfully recovered.

Spear phishing attempts tend to be far more focused phishing emails and only go to a single individual or at most, a handful of individuals. In these instances, the cybercriminal is likely looking to gain specific information, potentially information to aid in further attacks. Cybercriminals have all the time in the world to gather data on your organisation, and the publicly available information can be very useful to attackers.

Whaling as it is known, tends to be a more specific spear phishing attempt. These attacks are generally on the likes of corporate executives such as the CEO, CTO or CMO. These attacks are usually undertaken for monetary gains however they could very well be attempts to gain other sensitive information.

Identifying phishing attempts can be achieved with reasonable ease, it just takes some know-how and practice. The processes of reporting the threat to your organisation and employees requires foresight and planning. An efficient structured approach to dealing with these threats is somewhat of a requirement or all your efforts would have been in vain.

Consider the following high level questions when reading your emails.

The weakest link in the majority of organisations is, unfortunately, their employees. They can, however, become the strongest tool in your arsenals at defending against these fraudsters. Defending against phishing type attacks is achieved in layers, the most effective measure in the layered approach, is education. It is paramount that employees are taught to understand social engineering vectors such as phishing and what to look out for in communications. Your organisation should have a process for verifying the legitimacy of requests and reporting potential fraudulent ones.

Defence In Layers
Employee education around CEO Fraud, phishing and other social engineering vectors

Defined process for authenticating requests and reporting potential phishing attempts

Multifactor authentication on any publicly accessible portals (such as email)

Ensure computer systems are secure and regularly patched

Understand what information is publicly available concerning your organisation

A competent antivirus solution should be installed on all corporate systems

Understand what information is publicly available in relation to your organisation

A competent antivirus solution should be installed on all corporate systems