The majority of spear phishing attempts are aimed at employees. According to Statista, 87% of attacks of this type occur during the working week.
In most cases, cyber experts claim that successful phishing leads to stolen data, leaked credentials, or further criminal activity such as identity theft or ransom requests.
Such breaches can compromise a lot of lives for companies that hold sensitive information about their users, teams, and business.
Tech-savvy job candidates are susceptible to this threat as well. Microsoft recently warned of scammers that send personalized fake job invites to IT staff and software engineers.
Spear phishing is unlike other scams. Hackers that rely on this technique will find out everything they can about their target before they approach them.
They’ll scour their social media and company pages. Special attention will be paid to LinkedIn. A simple Google search will reveal what they do in the company, what type of job they’re looking for, who they socialize with, who their job is, how they speak, and more.
Therefore, teams are highly likely to be targeted with successful spear phishing attacks. What can businesses do to protect them?
Implement Employee Training
In cybersecurity, spear phishing falls under social engineering attacks in which criminals target people within the company through which they could gain deeper access to the network.
Humans are the weakest link if they lack cybersecurity training, because many people:
- Believe that they would never fall for a scam.
- Hacking involves highly technical methods.
The training bridges the gap between common myths that workers believe when it comes to cybersecurity. Also, it teaches them awareness and all about the signs that a hacker is on the other side of the screen.
It reminds them that most hacking is not high-technical in nature, but instead that threat actors tend to “hack people” before they attempt to breach systems.
Introducing cybersecurity training can aid employees to recognize common threats such as phishing (in its various versions), other hacking techniques that target workers, and inform them on the best practices in security (such as how to set up a strong password).
Reconsider Content Published on LinkedIn
As mentioned, when the threat actors target the victim, they find out everything they can about them and the people they associate with.
Social media is a cybercriminal’s oyster. It gives all the information they need to organize a successful spear phishing campaign.
CEOs and prospective job candidates have been sharing on their LinkedIn more than ever. For criminals, that creates a goldmine of information – especially when it’s paired with all the data they can find on personal social media.
True, social media can be set to private and people who send requests can be inspected before they get access to one’s personal photos and life updates.
However, with job posting sites such as LinkedIn that are meant to be public, workers and job candidates should be more careful.
When crafting the next motivational LinkedIn post, it might be valuable to think as a criminal and consider whether the data in the post might reveal compromising information to hackers
Use Email Filters and Flag External Addresses
Even though spear phishing can occur via SMS and social media, emails are still hackers’ favorite. Everyone has an email address – and workers have at least two.
For hackers, it’s also easy to find emails. They are noted on the resumes, LinkedIn, and websites of businesses.
Therefore, it’s important to have a security system that can recognize external emails – from entities and individuals with whom the company hasn’t yet been in contact, and that are outside your organization.
Otherwise, mistakes happen. Employees might accidentally click the link in the email they believe is from their coworker or a potential client – but is in fact malware.
One reason that this slip-up happens is that criminals create email addresses that are similar to those that the organization uses for work.
For example, the email address has a suffix that has only one letter different from that used by the company.
In a hurry, the employee might not even notice that difference and think that the message is from the boss higher-ups in the company might make a transfer or send their credentials to the attacker.
By marking the external email, such mistakes are less likely to happen during busy working hours.
Implement Software That Recognizes Spear Phishing
Traditional protective tools that most companies have such as firewalls and antivirus often fail in recognizing the more sophisticated scans such as spear phishing.
Such emails are personalized and might not follow the scheme that is usually instantly filtered out in the spam folder.
Modern anti-phishing software uses the capabilities of artificial intelligence (AI) and Natural Language Processing (NLP) to identify emails that contain any hints of phishing.
It can catch the subtle signs of spear phishing in the message and alert the IT teams as well as the workers to take precautions in time.
Conclusion
In a nutshell, some top anti-phishing practices include introducing basic cybersecurity training for employees, having tools that can detect spear phishing attacks, and including email filters that can flag suspicious external emails right away.
Spear phishing is one of the many types of phishing that criminals use to target companies.
Compared to phishing which focuses on quantity and sending as many emails as possible and hoping to catch something, this kind has greater chances of resulting in a successful scam.
Employees are more likely to give in to requests that they believe are from their boss or higher-ups in the company. Also, most people don’t expect that the scam is going to be tailored in a way that targets them specifically.
Being aware of the possible threats can help businesses to avoid dangerous attacks and protect their employees from leaked data and compromised access to working devices.
