How to prevent spear phishing in your business

Phishing attacks are changing. Increasingly, threat actors are taking a quality-over-quantity approach to phishing, ditching the mass spam in favor of crafting well-researched and highly personalized attacks tailored to a specific target.

Read on to discover how spear phishing works, the damage it can cause and what helps protect from spear phishing.

What is spear phishing?

Phishing is a type of social engineering attack in which cybercriminals impersonate legitimate organizations in order to deceive people into providing sensitive information such as credit card numbers and login credentials. This information can then be used to gain unauthorized access to the victim’s account, and can often lead to identity theft and/or financial loss. Phishing can also be used to trick people into installing malware on their devices. Every day, billions of phishing scams are delivered across a variety of channels, including email, text message, telephone, and social media.

Threat actors have traditionally taken a shotgun approach to phishing, distributing scam messages to as many targets as possible in the hopes that a fraction of them will take the bait. But this is changing. With email services getting better at filtering out phishing emails (Gmail alone blocks more than 100 million phishing emails every single day) and users cottoning on to the telltale signs of generic phishing scams, threat actors have pivoted to a more targeted approach: spear phishing.

Spear phishing is more sophisticated than regular old phishing because it’s customized to the target. Whereas regular phishing scams are distributed en masse, spear phishing attacks are painstakingly crafted to deceive a specific person, group or organization. Spear phishers often spend a significant amount of time trawling through the Internet, social media, the dark web, and data leaks, to collect as much personal information as possible about the target, including their name, job title, location, email addresses, family history, hobbies, recent purchases, and more. Threat actors can then use this information to create a highly personalized and highly believable spear phishing email, while impersonating a reputable entity – often a business, government agency, colleague, or boss – that the victim knows and trusts.

Because spear phishing messages contain accurate personal information that appears to have been sent from a trusted source, they’re often difficult to spot – even for employees with a good level of cybersecurity savvy.

The consequences of spear phishing

Spear phishing is a popular attack vector for one simple reason: it works. Spear phishing campaigns are effective, relatively easy to deploy and a successful attack can cause all sorts of headaches for the victim .

A successful spear phishing attack can lead to:

• Data breach: Spear phishing may be used to coerce the target into divulging corporate login credentials. Once the threat actor has gained access to the network, they can freely do anything within the compromised account’s privileges, which may include stealing and leaking sensitive data such as financial information, trade secrets, personally identifiable information of the company’s staff, clients or suppliers, and more. Phishing attacks are involved in more than a third of all data breaches.
• Ransomware deployment: Spear phishing is also commonly used to distribute ransomware, a type of malware that prevents you from accessing your data until you pay the ransom – typically, a six-figure sum paid in cryptocurrency. A ransomware incident can be extremely disruptive to a company’s normal operations and costly to remediate. Phishing is involved in about 45 percent of ransomware incidents.
• Reputation loss: Customers want to associate with organizations they can trust. A data breach can cause significant reputation loss and may prompt customers – both existing and prospective – to take their business elsewhere.
• Lawsuits: Depending on the scale of the incident, spear phishing can result in lawsuits from disgruntled customers whose data was impacted in the incident.
• Regulatory fines: In addition to customer litigation, there are also regulatory penalties to consider. Organizations have a legal responsibility to securely collect, manage and store user data. Failure to do so can potentially lead to hefty regulatory fines and compliance auditing.

What helps protect from spear phishing?

While spear phishing attacks can be difficult to spot, there are a number of things you can do to keep your organization safe. Here are five key spear phishing prevention strategies you can implement to protect your company.

Train your team

Preventing spear phishing starts with your people. Because phishing relies on human error, providing employees with the training they need to recognize and respond to spear phishing attempts can help your business greatly reduce the risk of becoming a victim.

• Detection: Staff across every level of your organization should be trained to recognize the signs of a phishing email, such as spelling and grammar errors, suspicious email attachments, and unusual requests for personal information.
• Verification: Implementing multiple checks and controls can help prevent spear phishing. Consider enforcing a two-step verification process for certain financial transactions and important email requests. Requests should be verified through a secondary communications channel in case the original channel has been compromised.
• Privacy: As noted earlier, threat actors often create their spear phishing messages based on real information gathered online. To mitigate this risk, encourage your team to be mindful of the content they share on social media and to manage their privacy settings to keep their accounts as private as possible.
• Response: Establish processes for verifying requests and document your escalation processes so that employees know who to report suspicious emails to. IT personnel can use this information to spot phishing trends and/or shape future training sessions.

Training should ideally be provided on an ongoing basis to ensure staff are up to date on the latest spear phishing techniques and other relevant cybersecurity threats.

Deploy endpoint anti-phishing tools

In the event that an employee falls for the bait, it’s important to have the right anti spear phishing tools in place to limit the impact and prevent a misclick from snowballing into a bigger problem. So, what helps protect from spear phishing?

• Antivirus software: Deploying a robust endpoint cybersecurity solution is crucial for intercepting the malware that is commonly delivered through phishing attacks. Emsisoft Anti-Malware, for example, features multiple layers of protection technologies carefully engineered to stop spear phishing attacks and other cyberthreats. It ships with the Emsisoft Management Console, a free, industry-leading remote management portal that allows you to manage your endpoints from a single web-based dashboard.
• Anti-phishing browser extension: While most modern browsers come with fairly effective phishing protection technology, you can take your organization’s security to the next level by deploying a dedicated browser extension. We recommend Emsisoft Browser Security, a privacy-conscious browser extension that prevents phishing attacks and blocks access to malicious websites that are known to distribute malware.

Use two-factor authentication

Two-factor authentication (2FA) is an additional layer of security that can help to prevent spear phishing attacks. With 2FA, a user must provide a secondary piece of identification in addition to their password in order to access an account or service.

The secondary piece of identification can take many forms, including:

• Single-use codes delivered via SMS.
• Time-based one time passwords generated via a smartphone app.
• A push notification.
• Hardware keys.
• Email-based authentication.
• Biometric authentication, such as a fingerprint or retina scan.

Some 2FA solutions also provide real-time alerts when a user attempts to log in from a new device or location, which can security administrators detect and respond to unauthorized access attempts. 2FA is a simple and effective form of spear phishing protection and should be implemented system-wide wherever possible.

Use email verification tools

There are a number of tools that can be used to verify the legitimacy of an email. They are particularly useful for stopping spammers from impersonating your business and sending emails on behalf of your domain.

They can also be used to mitigate business email compromise attacks, a specific type of phishing attack that occurs when a threat actor gains access to the email account of a high-level employee and uses the account to trick the target into sending money or divulging sensitive company information.

Email verification protocols include:

• Sender Policy Framework: Allows the owner of a domain to list the services that can send emails on its behalf.
• DomainKeys Identified Mail: A digital signature that is attached to outgoing email, which can be used to validate the source of an email.
• Domain-based Message Authentication Reporting and Conformance: Is used to set policies for both SPF and DKIM. For example, domain owners can choose which authentication method(s) should be used, and whether an email that fails authentication should be quarantined, rejected or delivered. DMARC can also be used to generate reports, which can help admins identify trends and adjust their policies accordingly.

Conclusion

Phishing attacks are becoming scarily convincing as threat actors invest more time into creating highly personalized campaigns tailored to a specific target.

For time-poor employees already contending with an overflowing inbox, identifying a spear phishing message is often easier said than done. Still, there are many spear phishing attack prevention strategies you can use to mitigate the risks. Comprehensive staff training is crucial for empowering your people to combat phishing, while spear phishing solutions such as endpoint security tools, two-factor authentication, and email verification processes provide additional layers of assurance.

Defend your business against spear phishing with Emsisoft Anti-Malware, a powerful endpoint cybersecurity solution built to protect organizations of all sizes. Download your free trial today.