PRODUCT SOLUTIONS PARTNERS RESOURCES COMPANY SEARCH BOOK MY DEMO Phishing Definitions The Definitive Guide Extended Definition of Phishing Define Phishing /fiSHiNG/ An attempt to acquire sensitive or confidential data by masquerading as a trustworthy entity. Phishing is the first phase in over 95% of cyber threat campaigns and takes the form of a variety of email, network, and web lures. The essential element is the misleading of an unsuspecting victim with bait such as benign-appearing files to download, links to click, or forms to complete, whereby the victim unknowingly transfers data or information needed to effect a breach or theft. To execute a phishing attack, criminals must understand basic human behaviors and how to use psychology to mislead their intended victim into divulging sensitive information. Some attempt to instill a sense of urgency in the recipient by threatening to cut off access to an account or service, such as a bank account, or an online streaming service unless they provide specific information requested in the message to unlock their account. Alternatively, others might announce the existence of a rebate or refund, contingent on the user confirming their billing address, account number, and/or password. Either through trust or coercion, the attacker tricks their victim into providing sensitive information. Nonetheless, the most common are phishing emails that don’t require the recipient to do much more than open the email and click on a link, such as the tracking number corresponding to the delivery of essential packages. By clicking on the link, the user infects their device with malware, specifically keylogging software which allows cybercriminals to capture the user’s online credentials covertly. While these types of phishing attacks succeed due to the sheer volume of emails sent, spear-phishing, where criminals target specific executives, and whale phishing, which focuses on high-profile individuals with access to considerable wealth or power succeed due to the amount of personal information criminals gather and include in the email. For example, in a spear phishing scheme, a criminal may email a company’s CFO with a request to pay a past due invoice from an established vendor. The critical element of the phish is the fact that it references a vendor known to the CFO. In that respect, the email appears routine, non-threatening, and in the spirit of maintaining a positive relationship with the vendor, merits were opening and following the instructions it provides. Bottom line: For an attacker to establish trust and a phishing scheme to succeed, the victim must view a malicious email or website as trustworthy. Whether they use fear, the existence of a financial reward, or a false state of emergency, the goal of any phishing scheme is to lower the intended victim’s guard by sending a phishing lure that appears legitimate. With their guard lowered, they share information that otherwise they would not. A Brief History of Phishing Attacks How did phishing schemes evolve? Why do attackers continue to rely on phishing to commit fraud and identity theft? How have phishing attacks evolved since the early days of the internet and what does the future hold when it comes to combating phishing attacks? Think back to the first time you ventured online. Like millions of others, you probably used an online service provider such as America Online to do so. While they lacked the sophistication of today’s scams, even back then, phishing scams took place. Instead of committing lucrative crimes, such as bank fraud, attackers focused initially on assuming control of an individual’s email account to send spam emails. In its next iteration, criminals created emails supposedly from AOL and other companies with a burgeoning online presence to ask victims to update their billing information. Using this approach, instead of stealing login credentials associated with an email account to send spam, criminals started phishing for credit card numbers, bank accounts, and billing addresses. Nonetheless, given the number of typographic errors criminals made coupled with their inability to create a compelling copy of a company’s website, detecting a phishing email or a phony website didn’t require a great deal of expertise. More often than not, criminals made a critical error by misspelling a simple word, or even the company’s name the email purported to come from that entity. Today, phishing schemes involve a far more sophisticated type of perpetrator who possesses the financing and technical know-how to launch highly effective attacks on government and corporate networks. And instead of remaining the domain of foreign cybercriminals, phishing is a global phenomenon, with attacks emanating from every country on the plant. Common Phishing Methods Many names, but they're all the same. Phish. Adware Adware is software that presents unsolicited advertisements to computer users, typically when using an Internet browser. The advertisements are frequently presented as pop-up windows. Adware most frequently qualifies as a nuisance as opposed to malicious software. Some forms of adware monitor users’ activities without consent and report it to the originator. This may be to track a user’s browsing habits in order to serve more targeted advertisements. Some modern adware are capable of disabling antivirus programs in order to circumvent being blocked. Anonymous Mailer Backdoor Business Email Compromise Credential Harvester Clone Phishing Drive-By Attack Dropper Email Spoofing Extortion Identity Deception Malicious Attachment Malvertising Ransomware Scam Snowshoeing Spear Phishing or Targeted Phishing Vishing Watering Hole Whaling Any Firm Can Fall Victim to a Phishing Attack While phishing takes place with alarming regularity, more often than not, successful phishing attacks go unreported. There are several reasons for the lack of reporting. Organizations subject to phishing don’t want to publicize the success of an attack at the risk of attracting additional attempts. Additionally, it may take the company months, sometimes years to uncover evidence of a phishing scheme. Neither the fact that an attack occurred and took months to detect plays well in the court of public opinion – especially if cybercriminals used their access to steal sensitive customer data. Nonetheless, attacks against notable victims including RSA, Sony, Home Depot, JP Morgan Chase, Anthem show that despite dramatic increases in the investment of cybersecurity technology and concerted efforts to educate executives, employees, and contractors of the characteristics of a phishing attack, cybercriminals continue to breach corporate networks with impunity. And it’s not just businesses that struggle to combat the threat, in the United States political arena, individuals on both sides of the aisle have found their emails posted online for public consumption. What Most Companies Get Wrong About Phishing In the fight against phishing, some organizations believe the myth that security training is the most effective way to prevent a phishing attack. While training is undoubtedly beneficial in helping individuals understand the severity of the threat, and the characteristics of a phishing email, expecting employees and executives to keep what they learned at the forefront of their mind is unrealistic. Even if an individual paid close attention during every security training, cybercriminals design phishing attacks using all manner of psychological techniques, to cause the recipient to react and engage in the behavior specified in the email, then only after the fact, think about the wisdom of their actions. By then, the damage is done. Simply put training matters, and it can help prevent phishing attacks, but it’s just one component of an effective anti-phishing program. The Best Way to Secure Your Employees Against Phishing Despite the existence of perimeter defenses, spam filters, and ongoing employee education programs, phishing attacks remaining the leading cause of data breaches. Whether an attack comes via email, the web, social, or network vectors, Area 1 Security’s cloud-native solution uses various tools and techniques, including globally-distributed attack sensors, and a comprehensive suite of analytics to identify and preempt phishing attacks in their infancy. And while many mass-market solutions cannot detect low-volume, highly targeted attacks Business Email Compromise schemes often exact the most financial damage. Area 1 Security’s solution preemptive measures to thwart phishing against all attack vectors – including highly sophisticated BEC. ASSESS YOUR PHISHING RISK Detect. Disrupt. Defeat. No-Phishing Zone SCHEDULE A DEMO demo@area1security.com Sales 650.381.1647 15 N Ellsworth Ave, Suite 102 San Mateo, CA 94401 PRODUCT Overview Why Area 1 Technology Demo Request SOLUTIONS RESOURCES COMPANY About News Events Careers Contact Us Blog © 2021 Area 1 Security Trust Center Privacy