Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
5/13/2015
04:10 PM
Rees Johnson
Rees Johnson
Partner Perspectives
100%
0%

Teaming Up to Educate and Enable Better Defense Against Phishing

Companies need to both educate their employees and implement prevention technology.

No matter who you are, or how you get your email, you’re bound to be a target. That’s the inconvenient truth about phishing. The sheer volume is astonishing -- McAfee Labs found over 150,000 new phishing URLs in the fourth quarter of 2014 alone. Couple that with Verizon’s finding nearly one infive users will click on a link within a phishing email, and the reality sets in. This is an uphill battle, and end users are on the front lines.

But it’s not just volume that results in compromise. More often than not, the phishing emails that result in a successful breach utilize highly sophisticated malware, social engineering, and are targeted at the most vulnerable amongst us.

At Intel Security, we have our sights honed in on this problem. To help companies’ efforts to reduce their risk and susceptibility to phishing, we teamed up with CBSNews.com to bring the issue to light on a global scale, raise awareness, and further educate the public.

Back in December, we released the first stage of our educational program -- an online quiz that asks people to identify whether a set of 10 emails are legitimate or phishing. Quiz takers can then review what they got wrong, and what they should have looked out for. It’s a simple concept, but a powerful one. Looking at our inboxes every day, not all of us think “Is this a real email?” But we should! Vigilance against social engineering is every individual’s responsibility. We recently published a report on this titled “Hacking the Human Operating System,” which I recommend reading if you want to dig further into the psychological forces at play in these attacks.

Bottom line: If more of us were able to spot fraud, then no matter whose information it is -- whether personal or corporate -- there would be less of a chance for a criminal to commit theft.

You’re probably wondering how people performed on this quiz. Check out a followup article on CBSNews.com here and a few highlights below:

  • Only 3% of all respondents were able to identify every example correctly
  • 80% of all respondents misidentified at least one of the phishing emails
  • The 35 to 44 year old age group performed best, answering an average of 68% questions accurately
  • Of the 144 countries represented in the survey, the U.S. ranked 27th overall in its ability to detect phishing, with 68% accuracy

One of the key takeaways in the aforementioned report is that “during a social engineering attack, the victim is not consciously aware that his or her actions are harmful.” Of course, in most cases, users are not intentionally infecting themselves with malware or divulging sensitive information. Preventing the impact of phishing requires a two-pronged approach: Companies need to educate their employees, and they need to employ prevention technology. By scanning every email for known bad senders, malicious files, and malicious URLs, organizations can reduce the attack surface immediately. Innovative approaches to threat detection like click-time malware scanning for URLs in email and attachment file sandboxing are new and effective ways to stop attacks.

Take a look at your email environment. If you’re running traditional Exchange on-premises, or managed by a partner, make sure you have email protection scanning the inbound and outbound flow of mail. If you are like many others in IT right now, you’re probably evaluating or already moving to a hosted Exchange environment such as Microsoft Office 365. The same concept applies. You need strong threat detection for your email, including defenses like click-time malware scanning to keep up with the dynamic nature of malware infection used in sophisticated phishing attacks.

I’m sure this isn’t the first time you’ve heard about phishing, and it won’t be the last. Take the right steps now to protect your organization.

Rees Johnson is Senior Vice President and General Manager of the Content Security Business Unit at Intel Security, which includes Web Security, Email Security, and Data Loss Prevention technology.  Rees and his team are in charge of securing the most utilized vectors of ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
100%
0%
RyanSepe,
User Rank: Ninja
5/14/2015 | 8:44:08 AM
Re: 1,500 Phish a Month
Ah ok, thanks for clarifying. I would imagine pulling sites is based on a "level of integrity" basis. This makes much more sense, thanks again for elaborating.
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
5/14/2015 | 8:39:37 AM
Re: 1,500 Phish a Month
I don't mean to call out a single site, but I happen to like OpenDNS who developed PhishTank.  I think the value in DBs like this is based upon the fact that data does rapidly change for phishing sites.  With a model like PhishTank where you can develop your own anti-phishing apps against an OpenDNS API, you can actually rapidly log and pull sites, cross-reference and protect with fairly high accuracy.  Nothing's perfect, of course.  Like any spam filter your phishing filter will have flaws, but as the DB, the data and the apps developed to use them mature, their usefulness will become much more clear. 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
5/14/2015 | 8:17:43 AM
Re: 1,500 Phish a Month
I'm interested in this statement, "I like projects like PhishTank where you can report suspected phishermen and slowly build a database of confirmed malicious emailers."


Could you elaborate more to the value this provides? It's very easy to change email addresses so I don't see how the database would be overly effective. The source could easily pivot and keep on going with the recipient database they have. Thanks,
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
5/14/2015 | 2:41:02 AM
1,500 Phish a Month
Between all my email accounts, I've estimated that I get roughly 1,500 phish a month.  Mind you, this isn't junk mail - these are emails that contain verbiage and links designed to extract information, to get me to login to a site with a pretense that ideally will convince me to use credentials tied to my finances, etc.  

My way of dealing with this is simple.  I've built a dictionary that is a compilation of keywords and phrases culled from this monthly mountain of madness.  Line up with any number of individual keywords or phrases, and my filters are permanently deleting you, after logging a tick for your status as "another one of those..."

Of course, this is not what I want to do.  I'd rather respond back in kind, perhaps with a bit more venom in the response, and crush them at their own game.  Phish for my banking credentials, get hit with a virus in return.  Of course, the problem is even the most talented of InfoSec pros have a hard time tracing phish back to their home schools...

I like projects like PhishTank where you can report suspected phishermen and slowly build a database of confirmed malicious emailers.  It's not as glamorous as dropping the phisherman by sending back a shark, but it does a public service in pulling together victims of common crimes to aid others avoid being hit.

In time, these databases will be valuable and just having access to them could eventually come at a price.  Jump on them now while most are still free.
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Enterprise Cybersecurity Plans in a Post-Pandemic World
Download the Enterprise Cybersecurity Plans in a Post-Pandemic World report to understand how security leaders are maintaining pace with pandemic-related challenges, and where there is room for improvement.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-29763
PUBLISHED: 2021-09-16
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 under very specific conditions, could allow a local user to keep running a procedure that could cause the system to run out of memory.and cause a denial of service. IBM X-Force ID: 202267.
CVE-2021-29825
PUBLISHED: 2021-09-16
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information when using ADMIN_CMD with LOAD or BACKUP. IBM X-Force ID: 204470.
CVE-2021-29842
PUBLISHED: 2021-09-16
IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0 and Liberty 17.0.0.3 through 21.0.0.9 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. IBM X-Force ID: 205202.
CVE-2021-29752
PUBLISHED: 2021-09-16
IBM Db2 11.2 and 11.5 contains an information disclosure vulnerability, exposing remote storage credentials to privileged users under specific conditions. IBM X-Fporce ID: 201780.
CVE-2021-34798
PUBLISHED: 2021-09-16
Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.