Art Jacoby says legitimate-looking emails are often a problem waiting to happen.
Gotcha!
You clicked on what appeared to be a legitimate link in an email and malware is now running on your computer. That’s phishing, defined by security technology firm McAfee as “tricking victims into divulging personal information such as credit card numbers or passwords by making use of fake web sites, spoof emails, and other persuasive techniques.”
Worldwide losses from phishing attacks over the 18 months ending December 2012 are estimated at $2.1 billion. And phishing attacks doubled from 2011 to 20122, to 102,100 per day. With mobile device use growing from 6 billion today to 12 billion within five years, there will be no shortage of points of attack.
There are clever names for various types of phishing — spear phishing (specific company targets), whaling (high-level executives), vishing (phone calls requesting information), smishing (text messages to your mobile phone) — but all involve pulling off a “con” on a human being to do something unknowingly harmful.
“Ninety-one percent of enterprise breaches are perpetrated by email-borne social engineering attacks,” said Rohyt Belani, CEO of PhishMe. In other words, a one-click mistake by one employee may be the weak link that compromises your security. Straightforward education, situational awareness and simple, best practices are critical for every organization.
The attacker’s objective may be to disrupt your business, steal your confidential information or add your servers to a web robot network called a “botnet,” said Jeremy Willingham, director of advanced cyber Training at TeleCommunication Systems Inc. in Annapoils. He cites an example of a law firm whose data was encrypted by attackers thereby preventing them from conducting business.
Art Jacoby, a business consultant and managing partner of Maryland Cyber Investment Partners, can be reached at art@artjacoby.com. He will be writing a regular column for the Baltimore Business Journal’s Cyber Biz. Jacoby has compiled a directory of Maryland’s cyber industry. Check it out at www.artjacoby.com/mdcyberlist