Top Cyber Security Threats for 2019

Phishing Attacks

Phishing, as in “phishing for phools”, is a cybersecurity approach that has been around for a long time. However, new defenses and security techniques have forced phishing to evolve. The proliferation of information provides attackers with new avenues to personalize their phishing attacks, and the same basic idea remains the same. A targeted message allows for unauthorized files and services to access the network. This section will explore the anatomy of a phishing attack, the threat that phishing attacks pose to an organization, and some practical examples of phishing in real-world situations.Phishing begins by collecting information on the target user or organization. These could be names, personal preferences, interests and hobbies, hierarchy information, and other details that could be employed in a phishing attack. Next, the attacker creates a phishing message tailored to the target’s information. If the target falls for the false message, unauthorized files are downloaded and sensitive credentials are revealed. The ultimate purpose of a phishing attack is to gather sensitive information and compromise the network. General phishing emails can be sent to lists of many addresses, but personally tailored “spear-phishing” attacks are more likely to succeed.

The Greatest Risk

Phishing attacks have been responsible for some of the largest data breaches in recent history. Organizations can invest their resources into advanced network security systems, but the user remains the greatest source of network risk. One successful attempt is all it takes to compromise a network entirely, and the covert nature of the attack means it can go undetected until it’s too late. The greatest defense an organization has against these attacks is training for the detection and avoidance of phishing emails. Even the most advanced security systems can be compromised by a single attempt at the user level.

Examples

Let’s explore some frequently used examples of phishing: False emails from a bank or other organization that request credentials as a matter of security, work orders from impersonated emails and compromised accounts, personalized messages that request sensitive information, and claims of untold wealth in exchange for a small fee. Phishing targets users who may not be familiar with computers, network security, or the nature of the attack. While some phishing is done with a personal focus on a specific target, the majority is a product of email addresses being sold to marketers and malicious hackers.Phishing attacks can be insidiously clever or extremely easy to detect. These attacks can be prevented by implementing policies that prevent users from getting phished. Not opening email attachments from unknown sources, double checking the transfer of sensitive data, and training for detection are all ways to prevent successful phishing and data loss. A company or person is only as strong as the weakest link. The user poses the greatest risk to an organization’s security, and phishing plays on this risk with targeted messages and false forms. It typically occurs over email, but it can also occur over messaging apps or any other personal communication channel.Most recently, the increase in telephone scamming has increased by upwards of 56% over the last year, and will only get worse. These phone scams are just another way a phishing attack can be done quickly and without much effort through the act of impersonation/spoofing.TL;DRPhishing is a cybersecurity technique that relies on user interaction with falsified messages. The ultimate goal of a phishing attack is to collect information and compromise the network’s security. Specialized messages convince “phools” to download unsafe attachments or provide compromising information. This section explores the anatomy of a phishing attack along with organizational risks and practical examples.