If I asked you to think of the number one cyber-attack affecting the US and global corporations today, your mind might immediately jump to hacking, but you’d be wrong. The number one cyber-attack is occurring right now, to countless organizations, all around you, likely even to yours.
This type of cyber-attack is industry agnostic and effects companies large and small. Its entry point into your company isn’t a server or a compromised application; it’s a simple, friendly email that has been sent to your accounts payable department. It’s personal, it’s targeted, and it’s called spear phishing.
Spear Phishing Is the Most Popular Email Fraud and Scam Method
Spear phishing has exploded as the most popular email fraud and scam method. The rise of social media and the expansion of a corporation’s virtual footprints (and associates digital footprints) has given criminals an unprecedented view into the people that populate the modern workplace.
Once a corporate target is identified, it’s exceptionally easy to build a digital picture of the corporate structures and decision makers, and critically, who pays the bills. Press releases, marketing materials, LinkedIn and Facebook, can all be mined for valuable personal and work history information which in turn is used to create highly personalized spear phishing emails. LinkedIn company updates can also provide valuable information about upcoming events, even an organization's next company annual meeting (that may include employee awards.) Phishers love to troll pages to find relevant info they can use to scam.
A popular current spear phishing method involves spoofing a corporate executive then targeting a direct report or the finance department to obtain digital codes for gift cards etc. Also common is identifying, then impersonating, a corporation’s key vendors, and supplying fake invoices which often are duly paid.
LinkedIn can be used to establish work histories and create false reconnections for old colleagues, first building trust, then exploiting it for criminal gain. What is particularly concerning when it comes to spear phishing attacks is that current anti-phishing technology is largely unable to detect it. Current generation technologies cannot simply or effectively identify the clever nuances of spear phishing attacks, too often they are armed with yesterday’s news instead of today’s threat assessment.
Most Current Methods of Detecting Spear Phishing Don’t Work
While some spear phishing attacks do follow a similar template, many of the anti-phishing solutions rely on phishing alerts from aggregator sites that update and collate new phishing attacks as they are detected. The challenge is that the anti-phishing software is often playing catch-up, locking the gate a day or two after all the horses have left.
We also see a generational shift. As younger employees enter the workforce, they are far more comfortable communicating electronically and are far less likely to pick up the phone. This inevitably makes spear phishing attacks more likely to work since the choreographed back and forth between the phisher and the victim and rarely involves any kind of verbal confirmation.
To try and supplement the struggling spam and malware filters, ‘phishing simulators’ and ‘training software’ have been deployed to attempt to train employees to self-identify and report nefarious emails and potential scams. However, the nature of spear phishing is such that creating effective simulations of what are often highly personalized and expertly tailored attacks is exceptionally difficult.
Further to that point, the value of simulation as a predictor of future behavior is very difficult to quantify accurately. The billions of dollars that flow out of corporate enterprises every year suggests that their effectiveness is greatly limited.
INKY is Different and Stops Spear Phishing In Its Tracks
Recognizing the deficiencies of current technology, we at INKY sought out to create a solution that would be effective today but ready for tomorrow. INKY’s Phish Fence platform is never a day or a week behind. It is perpetually up to date and in a constant state of evolution. With each email we process we come smarter and more adept at isolating and preventing spear phishing attacks. No spear phishing email is infallible, but they are often invisible to the human eye.
To counter phishing simulators and training software, INKY inserts color-coded ‘warning banners’ or phishing alerts in the body of the email to classify each message (safe, caution, malicious.) This real-time phishing email notification is much more useful to your employees than any simulation or training can provide. The banner is always visible, even on mobile and the ability to ‘report an email’ always available. Further, the banner is configured so that it does not block the subject line.
Our engineers have worked tirelessly to create a platform that is peerless and utterly unique. Indeed, we have never had a single report of a successful spear phishing attack across our installed base. INKY uses her intelligence to examine all aspects of a spear phishing attack to identify and prevent it. Further with each attack, that INKY prevents, her knowledge grows.
Spear phishing can be prevented but only with a platform built to do so. INKY can be installed and configured often in less than an hour, and an hour after install, INKY is sixty minutes smarter.
Learn more about how INKY can help you stop Spear Phishing and reclaim your confidence in your email. Sign up for your complimentary Email Security Analysis.
INKY – Phight Phish