Word of the Day: spear phishing

Word of the Day Daily updates on the latest technology terms | December 24, 2018 spear phishing Spear phishing is an email-spoofing attack that targets a specific organization or individual, seeking unauthorized access to sensitive information. Spear-phishing attempts are not typically initiated by random hackers, but are more likely to be conducted by perpetrators out for financial gain, trade secrets or military information. As with emails used in regular phishing expeditions, spear phishing messages appear to come from a trusted source. Phishing messages usually appear to come from a large and well-known company or website with a broad membership base, such as Google or PayPal. In the case of spear phishing, however, the apparent source of the email is likely to be an individual within the recipient's own company -- generally, someone in a position of authority -- or from someone the target knows personally. Visiting United States Military Academy professor and National Security Agency official Aaron Ferguson called it the "colonel effect." To illustrate his point, Ferguson sent out a message to 500 cadets, asking them to click a link to verify grades. Ferguson's message appeared to come from a Col. Robert Melville of West Point. Over 80% of recipients clicked the link in the message. In response, they received a notification that they'd been duped and a warning that their behavior could have resulted in downloads of spyware, Trojan horses and/or other malware. Many enterprise employees have learned to be suspicious of unexpected requests for confidential information and will not divulge personal data in response to emails or click on links in messages unless they are positive about the source. The success of spear phishing depends upon three things: The apparent source must appear to be a known and trusted individual; there is information within the message that supports its validity, and the request the individual makes seems to have a logical basis. Read more... Quote of the Day "The best way for IT to improve email phishing security is through comprehensive testing, which helps identify which users are susceptible and what type of fake email is most effective." - Kevin Beaver Trending Terms malware Trojan horse scareware phishing whaling social engineering Learning Center LifeLock vulnerability exposed user email addresses to public A LifeLock vulnerability exposed millions of customers' email address to anyone with a web browser, according to a report from Brian Krebs, and it jeopardized anyone using the identity theft protection service. Physical security keys eliminate phishing at Google Following a requirement for Google employees to use physical security keys, successful phishing attempts were completely eliminated, at least in part, because of the ease of U2F. Russian intelligence officers indicted for DNC hack As part of special counsel Robert Mueller's investigation into Russian interference with the 2016 presidential campaign, a grand jury indicted 12 members of Russia's GRU for the DNC hack, as well as other malicious activity. Phishing threats still dwarf vulnerabilities, zero-days Email security vendor Proofpoint released its Human Factor 2018 report, which details how phishing threats are evolving and still beating enterprise defenses. Seven factors that make up an effective email phishing test An effective phishing test should feature emails that include typical phishing indicators, such as misspelled company names. IT pros must have the support of management to effectively run a test, and they should include everyone in the company. Quiz Yourself Exploit kits allow non-technical threat actors to do ____ of damage. A. a lot B. alot Answer Stay in Touch For feedback about any of our definitions or to suggest a new definition, please contact me at: mrouse@techtarget.com Visit the Word of the Day Archives and catch up on what you've missed! FOLLOW US About This E-Newsletter This e-newsletter is published by the TechTarget network. To unsubscribe from Whatis.com, click here. Please note, this will not affect any other subscriptions you have signed up for. TechTarget, Whatis, 275 Grove Street, Newton, MA 02466. Contact: webmaster@techtarget.com Copyright 2018 TechTarget. All rights reserved.