Most companies do not have efficient security processes in place to respond to phishing e-mails, which are often the precursor to specific attacks where a company can be seriously hacked.
“Spear-phishing attacks against organisations are nothing new, but they are rising steeply in both frequency and complexity,” says Guillermo Lafuente, a senior security consultant at MWR specialising in social engineering attacks.
“These attacks start with an innocent looking email that appears to come from a trustworthy source but have evolved to the extent that often neither the individual nor the organisation are even aware that an incident has occurred until it is too late and confidential data has been stolen.”
He adds: “They are mainly designed to deceive employees, who are still seen as the ‘weakest link’, but we noticed that many companies do not have efficient internal incident response procedures in place to alert their staff about the threat.
MWR has identified a number of key processes that should be functional for an organisation to be able to resist these external threats, including the length of time before a phishing email is recorded as an incident and having effective out-bound email filters implemented to prevent the leakage of sensitive data.
Lafuente says: “For example, companies should be able to respond to a phishing attack within 15 minutes of receiving the malicious email. Efficiency at the early stages is crucial, however, many of them fail to react within the recommended time frame.”
Worryingly, phishing attacks are also commonly employed as an element of APT (advanced persistent threat) due to their high success and low detection rates, and the ease by which an attacker can target a large estate of users within an organisation.
Employees are then deceived into providing sensitive information or into performing actions such as downloading malware that could give an attacker access to the victim’s computer and even compromise the company’s entire IT network.