Just last week, new reports revealed more damage; in addition to the library of 56 million credit card accounts, hackers also gained access to 53 million customer email addresses. In the case of the Home Depot hack, cyber criminals accessed the enterprise with stolen vendor credentials, likely acquired through phishing campaigns.
The Home Depot hack is among several targeted major retailers this year. While businesses work to strengthen their cybersecurity posture, these attacks amplify the vulnerabilities of supply and distribution chains, and vendor systems used by countless organizations, regardless of industry.
Phishing scams are ubiquitous and often incredibly effective. ‘Smash and Grab’ describes attacks used to achieve quick monetary return, through access to specific financial data.
Spear-phishing is among a sub-set of phishing campaigns now gaining momentum. These attacks are far more surgical and often take more effort to execute. They target specific individuals within an organization, like a CFO or CEO. First cyber criminals gain access to the executive’s email account. Next they’ll drive the phishing campaign, usually by issuing a document to employee and requesting password confirmation for records update. In most cases employees will provide this information without hesitation, given that the source appears to be trusted.
These attempts are far more sophisticated than historical bids involving lottery or inheritance claims. Today, what we see are polished emails, perfectly branded to reflect a legitimate organization, like a trusted credit card company, bank or other vendor.
The objective is always the same – convince the recipient to enter their credentials by requesting identity verification. In a business setting, employees sifting through hundreds of emails daily could see such an email as innocuous, and click a link or submit credentials without thinking twice.
At eSentire, we see thousands of phishing attempts every week, and more than a dozen custom-crafted spear-phishing attacks.
So what can you do to protect your organization from the onslaught of phishing campaigns seeking to destroy and disrupt your organization? In addition to robust cybersecurity policies, staff training and education is critical. Be sure to communicate cybersecurity risks and the nuances of phishing to employees at any level across the organization.
In an era of multi-tasking and challenging workloads, employees must remain vigilant and cautious of suspicious emails as they are on the first line of attack. Legitimate organizations never ask clients or employees to click a link or enter confidential credentials via email or website submission. And if ever in doubt, don’t respond. Odds are an authentic request would be communicated by some other means.
Our motto at eSentire: don’t take the bait and don’t click the link.
Eric Ritter is Director, Security Operations Center and Client Experience at eSentire.
