In my previous column, I said that the No. 1 way to reduce IT security risks in your organization is to "simply" prevent end-users from installing stuff they shouldn't. This, of course, is much easier said than done.
Although infected innocent Web sites results in a large percentage of security breaches, fraudulent emails still abound. Unfortunately, long gone are the days when it was easy to identify malicious phishing email by their strange subject lines and horrible grammar.
[ InfoWorld's Roger Grimes explains how to stop data leaks in an enlightening 30-minute webcast, Data Loss Prevention, which covers the tools and techniques used by experienced security pros. | Learn how to secure your systems with InfoWorld's free security newsletter.]
Today's phishers, at the very least, are grammatically correct. The ones without enough education or experience to use language correctly naturally made less money and fell out of the criminal business early on; either that, or they hired smarter people.
The next generation of phishing messages, which is still prevalent today, strongly resembles legitimate messages from our banks, cable companies, online electronic payment services, and credit card companies. Everything in the emails looks legitimate, including the graphics that originate from the real company's Website. (The ones that included a notice to watch out for fake phishing messages always made me giggle.) The only thing that's fake in the entire message is the link that victims are required to click to complete the requested action.
This form of phishing is pretty effective, but the messages at least contain a small clue (the bogus URL link) to users that they should evaluate the legitimacy of the request. Today's browsers, with antiphishing features, might even warn an end-user against loading the bogus site.
But now end-users are being targeted by a new form of phishing, called "spear phishing," which specifically targets a user or company. Spear-phishing emails look more authentic than the aforementioned breed, often including the user's complete name or referring to a real project that the user is working on. Spear phishers often gather this information by doing tactical research or even breaking into a database, and it's effective enough to fool even the savviest end-users.
Often these forms of phishing attempt to entice the end-user into running a Trojan horse program, which then compromises the computer and the company's network. Most of the companies I work with these days have been exploited by one of these spear phishing e-mails. If the end-user is running antimalware scanning software, the product may block the Trojan install.