Phishing Impact Information Security
Phishing refers to a technique used by attackers to steal sensitive information such as passwords, account IDs and credit card information. Using a lure such as an expiring discount offer, warning that another account has been compromised or a time-limited ‘too good to be true’ offer, attackers attempt to trick the target into clicking on a link and revealing information to them.
A phishing attack starts with an attacker gaining access to a victim’s personal or work email address and any other information available on the Internet about them including their job, home town, hobbies or social media activities. This information is then combined with the attacker’s research on the victim’s information security and industry in order to create a believable fake message that appears to come from a trusted source.
The attacker then sends the lure to victims via email, phone or text message. Often the message will appear to be from their employer, bank or another reputable source and include a request for them to click on a link or reply with information.
Depending on the level of sophistication, an attacker may attempt to spoof the original URL in an email by creating a shortened or masked version and redirecting the victim to a malicious site. They may also use obfuscation of the web server to make it look more like a legitimate server (for example resolving the host name to a domain that matches the phishing site).
How Does Phishing Impact Information Security?
When a victim clicks on the phishing link or replies with their information, the attacker is able to access their computer and extract any stored data such as passwords, bank details, account numbers and credit card details. Attackers can then use the stolen information for a variety of reasons including money withdrawal, blackmailing and committing additional frauds.
As a result of successful attacks, the costs to an organization can be huge. According to the 2020 State of Phishing report from Proofpoint, attacks resulting in damage to information or a financial loss can cost an organization millions of pounds, not to mention lost productivity from employees, remediation time for information security teams and a damaged reputation.
Defending against phishing involves combining technical solutions such as filtering, firewalls and blocklists with human-centric approaches like employee training around the risks and how to identify phishing attempts. For example, employees should be taught to trust emails from their employer and other trusted sources and not click links or call anyone unless they have verified the request on another medium such as by telephone or a face-to-face conversation.
They should be taught to check for spelling and grammatical errors in the message which could indicate that it is not from a professional source and could have been written by someone with limited English skills or automated software (for example, a bot) or even worse, deliberately misspelt to bypass spam filters. Employees should also be encouraged to be suspicious of any messages that require urgent action or threats as these are a common tactic used by attackers.