Marketers need to be aware that phishing is a form of cyber-attack used by hackers to infect computer systems, defraud consumers, and discredit brands. According to the Anti-phishing Working Group (APWG), approximately 1,100 brands were hijacked by phishing scams in the first quarter of 2012. In these scams, attackers distribute fraudulent emails that appear to come from legitimate businesses. At first glance, the reply address seems credible, the branding is recognizable, and there is usually a call-to-action that compels the consumer to click on a hyperlink which seems appropriate.
The offending hyperlink can trigger a malware software download, or direct theuser to a compromised website to capture Personally Identifiable Information (PII) such as login and password, personal contact data, or method of payment for an erroneous product or service. The information gathered via the compromised website can be used to exploit and defraud the consumer who trusts your brand enough to provide sensitive information. Your consumers and your brands are both victimized in these attacks.
The phishing email can also contain an attachment with malicious software (malware) embedded in it; no need to open a hyperlink if the malware is attached directly to the email. Documents, including PDFs can be effective vehicles for embedding malware. While tools exist to protect consumers from malware infections, new threats are released daily and consumers should be suspicious of any attachments contained in an email, even emails sent by you—more on that in a moment.
While phishing attacks tend to be broad and untargeted, attackers can sometimes personalize their message in an attack type known as spear phishing. That’s right; attackers can use personalization to lend credibility to their messages by targeting specific individuals at specific organizations (sound familiar?). A colleague recently notified me of an email in which he and a former coworker were both asked to confirm billing information. This was an example of a spear phishing attempt because the attacker knew the names and email addresses of two people who worked together, thereby lending credibility to the message. My colleague wasn’t fooled, though, thankfully. Here’s a detailed video illustrating spear phishing.
As a marketing professional, you don’t need an exhaustive list of frightening phishing stories to understand the risks. The real question is what should you do to protect your brands from this evolving threat?
I have a few suggestions:
- Discuss cyber security with your IT department and service provider(s). Familiarize yourself with the precautions they use to secure your web properties, your internal systems, and the consumer data you are responsible for. Make sure these systems are defined as high value assets, and protected accordingly.
- Always use SSL certificates on websites when collecting Personally Identifiable Information (PII) from your consumers. An SSL certificate identifies your website as authentic (you are who you say you are) and allows the information exchanged to be encrypted (protected as it travels over the Internet.) Responsible web retailers require SSL for purchases, but you should also secure your preference centers with SSL as well. Again, talk with your IT department if you’re not sure how to verify this.
- Avoid distributing attachments via email to your consumers. Users who routinely receive attachments from you may not be suspicious of a document attached to a phishing email mimicking your brand. Many malware prevention tools will block your attachments anyway.
- If your organization doesn’t have a formal security policy and education program that addresses phishing prevention, push to have these created. Remember, if a user in your organization becomes a victim of a phishing attack, your corporate systems, including your web properties, are at risk.
- Have a phishing response plan. You’ll save precious time and credibility during an attack by having your response plan agreed upon in advance. Start by identifying internal stakeholders and making sure the responsibilities of their departments are documented and understood (Marketing, IT, Customer Service, etc.)
- What is your internal and external communication plan? Will you have a script ready to educate your consumers about the threat?
- Who will contact authorities and ISPs to take the offending website(s) offline?
- If your internal systems are compromised, what is the remediation plan, and in what priority order should they be repaired?
These suggestions are by no means meant to replace a comprehensive prevention and response plan, but I hope they get you thinking about the topic. The scary thing about phishing scams is that they target your consumers and put your brands at risk even if your internal systems are solid. Being aware, and prepared for, these harmful outside influences is a simple way to insure your own security and the security of your customers.
Have you had any experiences with phishing? Does your organization have a response plan in place if an attack occurs? Feel free to share your thoughts and ideas.
This article originally appeared on Quaero Blog and has been republished with permission.
Find out how to syndicate your content with Business 2 Community.