Phishing for Whales with Spears

There's no question that email has revolutionized the way we operate; it's hard to imagine ever operating without the ease and speed of communication that email enables. Unfortunately, for all of its convenience, email has opened the door to serious security threats that include viruses, malware and fraud. Phishing scams have become a widespread problem — you'd be hard pressed to find anyone who hasn't been on the receiving end of a phishing attempt. Because email is something we all use every day, it's become a favorite tool for those who are looking to gain illegal access to our business systems and sensitive information.

It's vital to continuously adapt security measures as threats evolve. Failing to prevent a breach can be devastating to your firm's reputation and finances. While the bad guys only have to be successful one time, we have to be successful every time. There is good news though: There are things that firms can and should be doing to minimize their risk and increase the likelihood that an email breach will be stymied before it succeeds.

Defining the Attack

At their core, all phishing scams are email attacks that attempt to steal sensitive information or obtain unauthorized access to systems. Attackers typically send out massive amounts of email with the intention of succeeding with only a small number of their recipients. Ordinarily, attackers attempt to pass themselves off as a person or entity known to and trusted by the recipient in order to trick the recipient into unquestioningly complying with their malicious request. The hope is that the emails prompt victims into clicking on links or logging into accounts to reveal or change their credentials. This process grants the sender illegal access as the link directs the victim to a webpage under the attacker's control.