Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Protect assets from ransomware, trojans, rootkits and more.
Intelligence and visibility across AWS, O365, DevOps and more.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
Just last week, new reports revealed more damage; in addition to the library of 56 million credit card accounts, hackers also gained access to 53 million customer email addresses. In the case of the Home Depot hack, cyber criminals accessed the enterprise with stolen vendor credentials, likely acquired through phishing campaigns.
The Home Depot hack is among several targeted major retailers this year. While businesses work to strengthen their cybersecurity posture, these attacks amplify the vulnerabilities of supply and distribution chains, and vendor systems used by countless organizations, regardless of industry.
Phishing scams are ubiquitous and often incredibly effective. ‘Smash and Grab’ describes attacks used to achieve quick monetary return, through access to specific financial data.
Spear-phishing is among a sub-set of phishing campaigns now gaining momentum. These attacks are far more surgical and often take more effort to execute. They target specific individuals within an organization, like a CFO or CEO. First cyber criminals gain access to the executive’s email account. Next they’ll drive the phishing campaign, usually by issuing a document to employee and requesting password confirmation for records update. In most cases employees will provide this information without hesitation, given that the source appears to be trusted.
These attempts are far more sophisticated than historical bids involving lottery or inheritance claims. Today, what we see are polished emails, perfectly branded to reflect a legitimate organization, like a trusted credit card company, bank or other vendor.
The objective is always the same – convince the recipient to enter their credentials by requesting identity verification. In a business setting, employees sifting through hundreds of emails daily could see such an email as innocuous, and click a link or submit credentials without thinking twice.
At eSentire, we see thousands of phishing attempts every week, and more than a dozen custom-crafted spear-phishing attacks.
So what can you do to protect your organization from the onslaught of phishing campaigns seeking to destroy and disrupt your organization? In addition to robust cybersecurity policies, staff training and education is critical. Be sure to communicate cybersecurity risks and the nuances of phishing to employees at any level across the organization.
In an era of multi-tasking and challenging workloads, employees must remain vigilant and cautious of suspicious emails as they are on the first line of attack. Legitimate organizations never ask clients or employees to click a link or enter confidential credentials via email or website submission. And if ever in doubt, don’t respond. Odds are an authentic request would be communicated by some other means.
Our motto at eSentire: don’t take the bait and don’t click the link.
Eric Ritter is Director, Security Operations Center and Client Experience at eSentire.
A passionate believer in superior customer service, Eric Ritter leads eSentire's global security operations teams. Eric is responsible for establishing collaborative relationships with educational institutions and regional government representatives which continues to cement eSentire’s expansion into new global geographies.