Although these questions are commonly posed by random individuals\nwho come across our blogs, they\u2019re sometimes posed by corporate executives \u2014 a\nfact that is particularly worrisome for obvious reasons. After all, if an\norganization\u2019s leader lacks that necessary knowledge or cyber security\nawareness, how can they expect their employees to be knowledgeable enough to avoid\nthe most common types of cyber attacks? Leaders need to lead by example, and\nthis means learning everything they can about these cyber threats.<\/p>\n\n\n\n
Phishing is a very real and very dire threat to\norganizations and individuals alike. In fact, in 2018 alone, nearly one-third\nof all data breaches involved various types of phishing attacks or tactics.\nWe\u2019re not just pulling this number out of a dark region; this\nresearch<\/a> comes from Verizon\u2019s 2019 Data Breach Investigations Report. This\nis just one of many reasons why phishing is so dangerous to businesses, brands,\nemployees, and consumers alike.<\/p>\n\n\n\n So, now, it\u2019s time to break down the internet age old\nquestions, \u201cwhat is phishing?\u201d and \u201cwhat makes phishing so effective?\u201d We\u2019ll cover\ndifferent types of phishing and will also dive into some of the ways to help\nmitigate receiving phishing emails and how you can prevent your brand from\nbeing used in phish that are sent to others.<\/p>\n\n\n\n Let\u2019s hash it out.<\/span><\/p>\n\n\n<\/span>\n\n\n Phishing is an overarching term for an entire category of\ncybercrime against people and businesses alike that involve cyber fraud. Based\non the concept of fishing, phishing is a virtual form of hunting that involves\ntricking users into \u201ctaking the bait\u201d and getting hooked. The category of attacks\ntypically involves cybercriminals impersonating a person or organization and\nusing various tactics to extract information or compel the victim to perform a\nparticular action. The attacks can be made via email, over the phone, using\ntext messages or even social media\naccounts<\/a>. <\/p>\n\n\n\n At its core, phishing is a medium<\/em> for an attack\nbut isn\u2019t the weapon itself. These attacks often require you as the victim to do<\/em>\nsomething \u2014 click on a link, open an attachment, download a file, etc. These\nactions typically will trigger the \u201cpayload\u201d \u2014 the actual weapon of choice \u2014\nwhich often comes in the form of malware or ransomware. However, some\ncybercriminals will instead drive you to a fake site that\u2019s designed to look\nlike the real deal. There, you\u2019ll be asked to update, change, or confirm\nsensitive information like your account information and passwords. <\/p>\n\n\n\n Research from Duo shows that 62%\nof simulated phishing campaigns<\/a> capture at least one set of user\ncredentials. Considering that it only takes one set of credentials for\ncybercriminals to break into your network, gain access to your databases,\naccess employee and customer data, etc., you can see why even one set of\ncredentials is such a major concern. <\/p>\n\n\n\n Phishing is about preying on the human element of\norganizations and businesses. In their annual Human\nFactor 2019<\/a> report, ProofPoint researchers indicate that \u201cmore than 99\npercent of threats observed required human interaction to execute.\u201d The study,\nbased on an analysis of 18 months of data, analyzed the company\u2019s global\ncustomer base. Less than one percent of the attacks targeted system\nvulnerabilities. <\/p>\n\n\n\n Some more involved types of phishing involve weeks or\neven months of pre-attack reconnaissance. This can involve cybercriminals using\nmalware, spyware, man-in-the-middle (MitM) attacks via unsecured Wi-Fi networks\nto monitor or insert themselves in their target\u2019s communications. They also\nwill often research the target online using websites such as Monster, LinkedIn<\/a>, and\nvarious social networking platforms. <\/p>\n\n\n\n But what does phishing look like? Let\u2019s paint you a\nnot-so-pretty picture: <\/p>\n\n\n\n It\u2019s a busy Friday afternoon in the accounts payable\ndepartment. Your employees are slammed with work when an email pops up from a\nregular contact at one of your IT vendors. The subject line says it\u2019s urgent:\nThere\u2019s been a mix-up with a payment, and your organization\u2019s account is\ndelinquent. The account needs to be brought current or else they\u2019ll stop your\nservice, which will bring your company to a grinding halt. The body of the\nemail goes on to explain the dangers of further delinquency and encourages to\nfix the situation ASAP. They also explain that their company recently updated\ntheir account and they provide you with their new payment information.<\/p>\n\n\n\n For the sake of expediency, your employee uses the new\npayment information the vendor provided to make the payment and continue on\nwith their day without another thought. What they don\u2019t realize, however, is\nthat it wasn\u2019t your vendor contact who sent you the email. It was a\ncybercriminal pretending to be him. Fast forward a couple of months and your IT\nvendor reaches out again. This time, however, they say that your account is\ndelinquent because they\u2019ve not received payment in a few months. Thinking there\nmust be a mistake, your employee goes back to verify the account because they\nknow they\u2019ve made the payment. <\/p>\n\n\n\n After some back-and-forth communications with the vendor,\nyour employee realizes that they\u2019ve been scammed and have been making payments\nto a fraudulent account. They come to you to find out what to do. You tell them\nto halt any future payments to the fake account and to try to reverse any\nprevious payments, but it\u2019s too late. The money \u2014 and the criminal \u2014 are now\ngone, and your company is now out thousands or even millions of dollars. <\/p>\n\n\n\n We all know this scenario isn\u2019t good for your\norganization\u2019s reputation. Nor is it good for job security. All you have to do\nis look at the headlines from recent years to see the impact of successful\nphishing attacks.<\/p>\n\n\n\n A similar\nscenario<\/a> as the one we described above happened to Facebook and LinkedIn. A\nLithuanian hacker sent a series of fake invoices to both companies while\npretending to a tech vendor they both did business with. Both companies fell\nfor the scam, and their mistake them more than $100 million combined between\n2013 and 2015. And they\u2019re not alone \u2014 even local\ngovernments<\/a> throughout the U.S. have fallen for multiple phishing scams\nthis year (and over the past several years) that resulted in costly ransomware\nattacks.<\/p>\n\n\n\n You may wonder how anyone can fall for such seemingly\nsimple tactics or obvious scams. But, remember: Phishing is about targeting\npeople in ways that catch them unawares. It\u2019s about making convincing,\nseemingly innocuous emails that convey a sense of urgency. This may involve contacting\nthe victim while impersonating someone they know \u2014 such as a friend, boss, or\nvendor contact \u2014 or by simply using urgent language that spurs them to take\naction now to avoid catastrophic consequences later.<\/p>\n\n\n\n ProofPoint\u2019s Human Factor 2019 research: <\/p>\n\n\n\n \u201cInstead of attacking\ncomputer systems and infrastructure, threat actors focused on people, their\nroles within an organization, the data to which they had access, and their\nlikelihood to \u201cclick here.\u201d Whether attacking at a massive scale in large, indiscriminate\ncampaigns, going after specific industries or geographies with more targeted\ncampaigns, or seeking out a single person within an organization, attackers and\ntheir sponsors consistently found human beings to be the most effective vectors\nto infiltrate organizations and facilitate fraud and theft.\u201d<\/em><\/p>\n\n\n\n So, why is phishing so effective? Phishing, in general,\nis all about creating a sense of urgency, plausibility, and trust. So, what are\nsome of the factors that come into play when it comes to phishing?<\/p>\n\n\n\n When it comes to answering the question \u201cwhat is\nphishing,\u201d it\u2019s important to recognize that there are many types of phishing. Some\ntypes of phishing are pretty generic in their approach while others are highly\ntargeted. You have the basic, old school \u201cNigerian Prince\u201d email scams. You\nknow, the whole \u201cDear friend, I have millions of dollars that I need to protect,\nand only you can help me do it!\u201d spiel. Then you also have the more convincing\nand planned types of phishing that are known as spear phishing or CEO fraud,\nwhich are far more convincing and pose significant threats to your organization.\n<\/p>\n\n\n\n Here\u2019s a hilarious variation of an old school spam-type\nphishing email that was received by one of our customer experience team\nmembers:<\/p>\n\n\n Wow\u2026 It looks like my colleague can retire early! Lucky\nlady.<\/p>\n\n\n\n But, seriously, it\u2019s hard to believe that someone is\ngoing to fall for this type of obvious phishing. But we know somebody,\nsomewhere is because if cybercriminals had absolutely no success with these\ntypes of messages, they wouldn\u2019t bother sending them. <\/p>\n\n\n\n The list of common phishing attacks doesn\u2019t end with just\nspam-type messages and spear phishing. And phishing attacks are not limited to\nemails alone. In fact, phishing can be conducted using a variety of\ntechnologies, including telephones, text messages, websites, or even social\nmedia accounts. <\/p>\n\n\n\n So, what are some of the most common types\nof phishing attacks<\/a>? We\u2019ve already spoken about many of these types of\nphishing in previous articles on Hashed Out, but we\u2019ll rehash them here briefly\njust to help remind you:<\/p>\n\n\n\n A BEC or CEO fraud attack typically involves an attacker\nimitating the company\u2019s CEO or another high-level executive and sending emails to\nlower-level employees directly with the goal of eliciting an intended reaction.\nThe goal could be to gain access to sensitive data or to get significant funds\nvia wire transfers.<\/p>\n\n\n\n Here\u2019s a CEO fraud phishing email example that our office\nmanager recently received:<\/p>\n\n\n This type of phishing involves a cybercriminal using the\nlanguage, design, and \u201cfeel\u201d of a legitimate message from a company and\ncreating a virtually identical, malicious version of it. For example, if\nsomeone regularly receives legitimate package tracking emails from FedEx or\nDHL, they\u2019re not likely to closely study every email to see if there are any\ndiscernible differences from the ones they previously received. They\u2019re more\nlikely to simply skim the email or jump directly to clicking on the fake\ntracking link. All it takes is one moment of unawareness \u2014 and that\u2019s what\ncriminals are counting on. <\/p>\n\n\n\n Much like how it sounds, domain spoofing occurs when a\nhacker uses either fake emails or fraudulent websites and makes them look like\nthey\u2019re legitimate. In the case of email, the criminal \u201cspoofs\u201d the emails to\nmake them look like they\u2019re coming from the company\u2019s legitimate domain. With\nthe website domain spoofing, they\u2019ll adopt the legitimate website\u2019s design and\nuse either a similar URL or use Unicode\ncharacters<\/a> to replace the ASCII characters in the domain. <\/p>\n\n\n\n Unlike the other types of phishing that made this list,\nan evil twin phishing attack is one that capitalizes on Wi-Fi. In this type of\nphishing attack, cybercriminals are like spiders: They spin \u201cwebs\u201d and wait for\ntheir prey to come to them. They do this by creating a rogue Wi-Fi hotspot that\nlooks legitimate \u2014 even using set service identifiers (SSIDs) that are the same\nas the real network \u2014 to trick users into connecting. This approach allows the\nattacker to eavesdrop on their network traffic to gather personal and corporate\ninformation without the victim being any the wiser. <\/p>\n\n\n\n This type of phishing is pretty basic \u2014 yet surprisingly\neffective. We\u2019ve previously written about how 58%\nof all phishing websites<\/a> are served via HTTPS. The trick to this type of\nphishing method is that the criminal sends an email with only a\nlegitimate-looking link in the body \u2014 either in a clickable- or non-clickable\nformat. <\/p>\n\n\n\n So, why would anyone be foolish enough to click on such\nan obvious phishing email? Because the attacker sends the message so that it\nappears to come from a legitimate source \u2014 the target\u2019s boss, family member,\nfriend, or even their CEO. It all comes back to the social engineering tactics\nwe mentioned earlier. <\/p>\n\n\n\n Smishing stands for \u201cSMS phishing.\u201d In a nutshell, it\u2019s a way for\ncybercriminals using text messages that appear to come from legitimate sources to\nlure users into downloading malicious payloads via malicious URLS. The links\ncould appear to be a coupon code from your favorite Mexican restaurant or even\nfree tickets to an upcoming show. Spear phishing is the antithesis of old school spam\nemails. Rather than blasting out emails to thousands of people in a massive\ngeneric campaign, this type of scam involves a phisher researching their target\nin depth. They often consult social media profiles and other publicly available\ninformation \u2014 to socially engineer a convincing scenario. This information is\nused to trick or compel the target into clicking on and engaging with the\nemail. The goal is to get them to provide information or perform a specific\naction. Because these emails are so highly customized, they often can avoid\ntraditional spam filters. <\/p>\n\n\n\n A vishing attack is simply the phone-based variant of\nphishing, or what\u2019s known as \u201cvoice phishing.\u201d This type of attack occurs when\na criminal calls via phone and tries to get you to either provide personal\ninformation or perform an action. Think of those notorious fake IRS phone calls\nwhere they tell you that you owe X amount in taxes and threaten to have you\nthrown in jail \u2014 a consequence you can avoid by simply making a \u201cpayment\u201d using\npre-paid gift cards. Yeah, that sounds legit. Who knew Uncle Sam was such a big\nfan of Amazon or iTunes?<\/p>\n\n\n\n Other forms of vishing include criminals pretending to be\nyour bank, credit card company, or even Marriott hotel and telling you that\nyou\u2019ve won a free vacation \u2014 all they need is some personal information. <\/p>\n\n\n\n This type of large-scale phishing attack targets\norganizations by identifying specific websites that they frequently visit \u2014\nsuch as a vendor\u2019s site \u2014 and infects one or more of those sites with malware.\nIn 2018, a watering\nhole campaign<\/a> compromised at least 21 major government and media websites\nin Southeast Asia. <\/p>\n\n\n In some ways, whaling is the lovechild of a spear\nphishing attack and a quasi-CEO fraud attack. Don\u2019t follow? Rather than\ntargeting low- to mid-level employees, whaling attacks target CEOs and other\nhigh-level executives with spear-phishing attacks. This is sometimes done while\npretending to be a third-party company or by impersonating an executive at\nanother office within the targeted organization. <\/p>\n\n\n\n But what do virtually all of these types of phishing have\nin common? They all use some type of technology, and many employ social\nengineering tactics. <\/p>\n\n\n\n Here\u2019s one example of a recent phishing email that\ntargeted one of The SSL Store\u2019s vice presidents:<\/p>\n\n\n Where phishing is concerned, there\u2019s always more than one\nvictim. Victims include: <\/p>\n\n\n\n When phishers use the names and brands to trick their\nvictims, there are certain corporations they use more frequently than others. The\nQ2 2019\nPhishers\u2019 Favorites report<\/a> from Vade Secure shows that Microsoft tops the\nlist of the 25 most impersonated brands in phishing attacks. The list of the brands\nmost commonly impersonated in phishing<\/a> is as follows: <\/p>\n\n\n\n Suffice to say, after all this, that we\u2019ve answered your\ninitial question, \u201cwhat is phishing?\u201d But now that you know what it is, how can\nyou prevent them from being successful? And how can you help prevent your own\norganization and brand from being used by phishers to victimize others?<\/p>\n\n\n\n Unfortunately, there\u2019s no one-size-fits-all solution when\nit comes to email security and stopping phish. However, there are a variety of\nbest practices and multi-layered defenses you can implement to protect your\norganization. Here are several methods and strategies you can use to arm\nyourself in the war of email security:<\/p>\n\n\n\n Not to sound cruel or completely pessimistic, but the\nthing that comes to mind is this unfortunate truth: There\u2019s a sucker born every\nminute, and some of them likely work for your company. This is why it\u2019s\nimportant to inform them through cyber awareness training. <\/p>\n\n\n\n Awareness training should cover multiple areas of\nconsideration, including:<\/p>\n\n\n\n This type of training, which should be held every three\nto six months (ideally), should be mandatory for everyone with access to your\nnetwork and databases. This includes all full- and part-time employees\n(including CEOs and other top-level executives), board members, and interns. <\/p>\n\n\n\n Related Resource:<\/strong> 10 Phishing Awareness Tips to Keep the Grinches Away<\/a><\/p>\n\n\n\n Although it\u2019s not ideal, it\u2019s not uncommon for employees\nto use their employer\u2019s devices (laptops, iPads, smartphones, etc.) for\npersonal purposes such as checking their personal email and social media\naccounts. This includes checking their email and social media accounts using\nthose devices. Or, your organization may even allow employees to bring their\nown devices (BYOD). While this can initially save money in the short run, if\nthose devices are infected and are used to connect to your network or log in to\ndatabases, you can face costly consequences in the long run in terms of data\nbreaches, ransomware, and security noncompliance fines. <\/p>\n\n\n\n One way to reduce the potential impact of phishing\nattacks is to limit access to sensitive systems to those employees who actually\nneed access to do their jobs. Dave in accounting doesn\u2019t need access IT\nadministrator access. And Sally in sales doesn\u2019t need access to payroll or\npersonnel records. <\/p>\n\n\n\n In addition to ensuring that only the employees who have\naccess actually need it, periodically review the list to ensure that those\nemployees\u2019 access needs have not changed. For example, if Paul in human\nresources quits or is fired, deactivate his credentials and access immediately\nto prevent him from having access to any sensitive data. <\/p>\n\n\n\n Truly savvy organizations use a multi-layered approach to\nemail security. We discuss several of these methods in our Email Security Best\nPractices eBook, which was created as a resource to help protect you from phish\nas well as keep you from being imitated in phishing emails that are sent to\nothers. We\u2019ll briefly discuss them below, but for more in-depth information \u2014\nas well as information about how to implement them \u2014 you\u2019ll want to check out\nour eBook: <\/p>\n\n\n\n\n\n Some of these technological methods to prevent being\nphish and used in phish include: <\/p>\n\n\n\n Having effective email security is no longer an option.\nIf you want to protect the reputation and standing of your organization, the\nprivacy of your employees\u2019 and customers, and the integrity of your data, then\nthese are all steps that you need to implement now. Now that you know what\nphishing is and how it works, there\u2019s simply no excuse to do nothing. <\/p>\n\n\n\n Phishing attacks aren\u2019t going to stop. Cybercriminals are\ngoing to continue to use them until they\u2019re no longer effective, and they move\non to using other tactics. The longer you wait to protect your organization\nagainst phish, the more at risk your business will be to phishing attacks and\nthe associated risks that come with them. <\/p>\n","protected":false},"excerpt":{"rendered":" An in-depth look at the types of attacks that are involved in 32% of all data breaches In our news-heavy world, there isn\u2019t a lot that surprises us anymore. But…<\/p>\n","protected":false},"author":17,"featured_media":11546,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[16],"tags":[167,166,168],"class_list":["post-2869","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hashing-out-cyber-security","tag-cybercrime","tag-phishing","tag-spear-phishing","post-with-tags"],"views":24653,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2016\/08\/What-is-Phishing.png","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/2869","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=2869"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/2869\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/11546"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=2869"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=2869"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=2869"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Phishing Definition: What is Phishing, or What Does Phishing Mean? <\/h2>\n\n\n\n
An Example of Phishing in Action<\/h3>\n\n\n\n
Spelling It Out: Why is Phishing So Effective?<\/h2>\n\n\n\n
\n
\n
![\"Top](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/05\/Emotional-Motivators.png\")
<\/figure>\n<\/div>\n\n\n\n
Types of Phishing Attacks<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/09\/SpamPhishing.png\")
<\/figure>\n<\/div>\n\n\nBusiness Email Compromise\/CEO Fraud<\/h3>\n\n\n\n
![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/09\/CEOFraudKyle.png\")
<\/figure>\n<\/div>\n\n\nClone Phishing<\/h3>\n\n\n\n
Domain Spoofing<\/h3>\n\n\n\n
Evil Twin<\/h3>\n\n\n
![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Evil-Twin.png\")
<\/figure>\n<\/div>\n\n\nHTTPS Phishing<\/h3>\n\n\n
![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/06\/HTTPS-Phishing-300x300.png\")
<\/figure>\n<\/div>\n\n\nSmishing<\/h3>\n\n\n\n
\n
\n<\/p>\n\n\n\nSpear Phishing<\/h3>\n\n\n\n
Vishing<\/h3>\n\n\n\n
Watering Hole Phishing<\/h3>\n\n\n\n
![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Watering-Hole.png\")
<\/figure>\n<\/div>\n\n\nWhaling<\/h3>\n\n\n
![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/07\/Whaling.png\")
<\/figure>\n<\/div>\n\n\n![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2016\/08\/CEO-Fraud-1024x579.png\")
<\/figure>\n<\/div>\n\n\nWho Are the Victims of Phishing?<\/h2>\n\n\n\n
\n
Top 25 Most Commonly Impersonated Brands Used by Phishers<\/h3>\n\n\n\n
\n
How to Keep Your Organization Safe<\/h2>\n\n\n\n
Implement Regular Employee Awareness Training <\/h3>\n\n\n\n
\n
Create Security-Oriented Computer Use and BYOD Policies<\/h3>\n\n\n\n
Implement Effective Access Management Policies and Processes<\/h3>\n\n\n\n
Use a Combination of Effective Email Protection Technologies<\/h3>\n\n\n\n
Final Thoughts<\/h2>\n\n\n\n