A Deep Dive on How to Catch Phish

The modern email threat. The simple plain text email appearing to come from the CEO asking the junior finance or accounts payable team member to immediately settle the overdue invoice from an irate supplier, that has just called them personally to complain.

Call it Business Email Compromise (BEC) or CEO Fraud, it’s still a targeted phishing attack, and the number of incidents has been rising steadily. Trend analysis here at CensorNet shows that these emails will soon account for 1% of all emails processed – or 1 in every 100 messages our customers receive.

Defending against this particular threat continues to be a major focus for the team, and an area of significant innovation and investment.

Whilst FBI Operation WireWire resulted in the arrest of 74 individuals in multiple countries last week – that still leaves plenty more Phish in the sea.

The problem with CEO fraud email messages is that they are notoriously difficult to detect.

In a recent attack, the only attribute of a message that was changed was the ‘Header From’ field. The display name in Outlook (other email clients are available) showed the CEO’s name.

(Note: Even the From address in < > next to the display name showed something similar to this email address – donotreply@executiveteeammailbox.com – which should have been enough to alert the user, but security education is not the topic of this blog post).

Nothing about the sender or sending server was suspicious. The IP address was not in any blacklist, the MX record was valid, the sending server matched domain and responded to an smtp probe. There was no SPF record.

We’re still undecided as to whether this makes the attacker super-smart or simple-stupid. The simplicity of the attack meant the message was likely to make it through most email defences, but would rely heavily on the recipient user being half asleep.

What this example does provide, is crystal clear evidence of the need for an ultra-modern and multi-layered approach to email security.

Traditional pattern matching / recurrent pattern matching technology is as much use as a chocolate teapot.

Content analysis – looking for message content that includes ‘urgent wire transfer’ or similar language can be effective but comes at a price. And that price is a risk of false positives – incorrectly identifying legitimate emails as ‘Suspect’.

Although, you could argue that quarantining the occasional message chasing payment of an invoice will help cash flow and is still better than inadvertently transferring $25,000 to an account in China or Hong Kong.

Algorithmic analysis is a powerful weapon in the arsenal for identifying scam emails, but even with over 1,000 algorithms examining over 130 elements of the message (in less than 200ms, about half the time it takes to blink), there was little (read nothing) to fire on in this case.

What was interesting about this particular attack was the domain that was used. It wasn’t a recently registered or new domain – it was almost a month old. It wasn’t a nearby domain (or cousin or typosquatting domain), so Levenshtein distance (one of our favourite algorithms due to its power and simplicity) wasn’t helpful. But. The registrant had a history of criminal activity – registering domains and using them in attacks – and that meant a high threat intelligence risk score.

What the attack also highlights is the need to identify the real names of key individuals in external emails – particularly in ‘Header From’. Building a list of names of the executive team and board members, and anyone else that’s an active spokesperson for the organization, and quarantining messages that contain those names, might not be sophisticated but is still a very valid defence.

As a last resort, some email security solutions rely on the user entering in to a conversation with the attacker – asking for more details about the outstanding invoice, or exactly what detailed (confidential or personal) information the sender needed – building up a risk score with each message exchange until a threshold is reached.

CensorNet invest in combining technologies and techniques that identify and block the initial inbound email. Tracking smtp conversations is still interesting. If a user receives an email from a sender for the first time that also contains potentially suspicious content, then a banner across the top of the email advising caution might just be enough to cause them to stop and think!

Ultimately a combination of content analysis, threat intelligence and executive name checking would have stopped this super-smart, simple-stupid attack. Is it time to think differently about email security.

Ultra-modern, multi-layered defence wins again.

Source: https://www.censornet.com/resources/blog/

Webinar Recording – Vulnerability Assessment Service

During this webinar you will learn how our service:
 Addresses the very real threat of insecure web applications
 Provides a snapshot of your current security posture highlighting issues requiring attention
 Quickly discovers security flaws in your network perimeter
 Scans and re-scans at your convenience and no extra cost
 Gives you reporting that’s simple to understand
 Provides evidence of ‘best practice’ whilst balancing budget expectations

Webinar: Network Utilities Managed Security Services

Here at Network Utilities we offer a range of services and enhanced support from simple pen testing to 24/7/365 telephone support to fully managing your IT security. The aim is to remove the burden of niggling IT issues or staff shortages allowing you to focus on your critical projects and business objectives.

Watch our snappy 30 minute webinar with our Principle Technology Strategist; Malcolm Orekoya and hear about our:

  • Security-as-a-Service
  • Network and Security Health
  • Training and Support services
  • Enhanced Support Services

Do you need any more info? Call us on 020 8783 3800 or fill out the form below.

.

Webinar: Prepare for tomorrow’s cyber threats today!

Watch our on demand webinar and take a dive into today’s data and cyber security threat landscape with our Principle Technology Strategist; Malcolm Orekoya and hear about:

  • The evolution of ransomware
  • How to boost cyber security awareness within your organisation
  • Data portability in your organisation
  • The importance of encrypted data visibility
  • How to prepare for the impact these cyber threats will have on your organisation

Network Utilities’ Services puts your business first, reduces your risk and helps you ensure your network is safe, secure, fast and compliant.

Privacy Is a Human Right; do you understand your data obligations?

On Thursday we gathered together with clients at information security consultants Blackfoot UK’s head office in London to talk about a trending topic in the IT world today.

Data and Cyber Security Matters in a Post Brexit World.

David Silsby our Sales Director welcomed us on this very chilly morning reiterating the Network Utilities ethos of “Identity should be at the heart of everything we do; the identity of the individual and the device is key! Remembering Who is on your network, What they are trying to access and How is critical to ensuring your network remains secure, fast and compliant.”

Next up was Matthew Tyler, CEO of Blackfoot UK and our keynote speaker for the day. Giving us a time hop into the past where we learned some interesting facts. The European Convention on Human Rights (ECHR) came into effect in 1953 and is an international treaty to protect human rights. The definition of privacy as in Article 8 states “A right for one’s ‘private and family life, his home and correspondence’ to be free from unlawful searches”.  In the UK human rights are protected by the Human Rights Act 1998. Matthew went on to explain how the internet has changed the economics of data and contributed to the erosion of privacy, he also detailed current privacy laws and how Brexit will change the future. Below you can see the 8 principles of the Data Protection Act, governing the use of personal information which we must comply with, unless an exemption applies, the principles state that data must be:

  • Used fairly and lawfully
  • Used for limited, specifically stated purposes
  • Used in a way that is adequate, relevant and not excessive
  • Accurate
  • Kept for no longer than is absolutely necessary
  • Handled according to people’s data protection rights
  • Kept safe and secure
  • Not transferred outside the UK without adequate protection

Data is an extremely powerful tool in today’s business world. Knowing your customer well can create a tailor made customer experience. The future of business intelligence is evolving and we will soon start to see new services and businesses arise to help us harness the power of this business intelligence.

iot_of_ransomware

Protecting your customer’s data has never been more critical

The cost of a data breach can have a huge impact on you and your business including; bankruptcy, reputational damage, legal implications and of course loss of data. You need to have the appropriate security in place depending on the value of the data you hold i.e. credit card details or email addresses. Do you know the value of your data? Do your staff know what risky looks like? And are they fully trained and aware of the implications of clicking on a malicious links, for example? Research tells us you are only as strong as your weakest link, and that in most cases is your staff.

This brings me onto 5 key questions posed by Matthew around what you need to be asking yourself and your business to truly understand the type of data your business holds.

  1. Do we know what data we have?
  2. Do we understand its potential value and the associated risk?
  3. Do we know who could want our data (for good or bad)?
  4. Do we understand where our data is and who can access it?
  5. Do we know what protection our data needs?

The cost of a data breach

The Cost of a Data Breach

* IBM Security 2016 – Cost of a Data Breach Study

If you would like to know more about European regulations and what’s changing in the UK, how to keep your customers data safe and the implications of personal data being lost or misused then you can download Protecting Data and Privacy to get a full overview. Remember you are only as strong as your weakest link!

Will the defenders ever be faster than the attackers?

Our Principal Technology Strategist, Malcolm Orekoya shared his research on the current threat landscape. Did you know that 89% of breaches had a financial or espionage motive?

In order for us to understand cyber security we need to understand the cyber-crime world. These attackers have the same technology advancements that we do and they are always one step ahead. The resources are available for anyone online and you can even pay for “cyber-crime” support. Organised crime is evolving quickly due to underground criminal networks and the so called dark web. The tools are getting smarter and depending on what these criminals are after they will attack in different ways.

“Analysis of known bad malware found that the 91.3% of that malware uses the Domain Name Service (DNS) to carry out campaigns.” Cisco Annual Security Report 2016

There has been an explosion in ransomware and exploit kits are sophisticated. “The Angler exploit kit is one of the largest and most effective exploit kits on the market. It has been linked to several high-profile malvertising (malicious advertising) and ransomware campaigns. And it has been a major factor in the overall explosion of ransomware.” Cisco Annual Security Report 2016

“33% of the malware observed in 2016 research used encryption.” Trustwave Global Security Report 2016

Most legacy platforms cannot see encrypted traffic therefore there is a loss of visibility. Malicious users are aware of this vulnerability and that you don’t have visibility so exploit this lack of visibility to insert their malware into your network. It’s crucial for you to have network visibility in order to be able to effectively apply security policies.

Education

People are your best network defence, but only if they are educated to understand the risks. We advocate creating a data security awareness culture. The one constant factor that exists in all layers of security is the human element. The idea here is to educate people on common threats and their various guises, test their understanding and responses to this education over time, review the results of such tests and then repeat the entire cycle periodically over and over again. You can read Malcolm’s full blog Stop Phishing Attacks – Harness the Power of Your Human Sensor Network – Here.

It’s not if; it’s when!

You need to collaborate to stay ahead of the trends and the cyber security landscape. Think ahead to prevent future attacks. Think of the cost and rewards of investing in your network security vs the risk of not doing so. Ask yourself, can you afford to lose it all when you do get attacked?

SC Magazine recently ran a survey on 900 business and IT decision makers across the UK – EU GDPR – nine out of ten don’t understand it. A staggering 91% of respondents have concerns about their organisation’s ability to comply with GDPR. This regulation will come into effect in 2018 and the penalties will be high, that might seem like a long way away but it’s just around the corner, and you’ll need to be prepared.

Talk to specialists who are confident about compliance and threat prevention. Talk to Network Utilities.

Upcoming events:

We will be hosting another webinar on the 22nd February 2017. To find out more on your obligations and how GDPR will affect you and your organisation join our webinar with information risk, security and compliance specialists Blackfoot. You can register here.

t: 020 8783 3800 e: sales@netutils.com

About Network Utilities
Identity Centric Networks & Security

Network Utilities (Systems) Ltd have been providing identity centric network and security solutions to organisations ranging from Telecoms and ISPs to large corporates and SMEs for over twenty three years. Partnering closely with both industry leading and niche technology vendors to bring customers the best solutions the industry has to offer. Read more at www.netutils.com.

Network Utilities to launch Monitoring-as-a-Service at IP EXPO

ip-expo-linkedin-imageAs you may or may not know we have recently launched our Monitoring-as-a-Service offering over the summer to help you plan for your IT holiday cover, as we all know networks, application and storage just keep on running.

We are pleased to announce that our expert team will be at IP EXPO on the 5th and 6th October to talk to you about our new Monitoring-as-a-Service offering. The service, delivered by a 24/7 UK based operations centre and technical team monitors network, server and storage architectures for both security and availability with optional pay-as-you go incident packs for rapid remediation of any issues.

“In the past, SMEs have sometimes overlooked managed services due to the perceived high cost and limited flexibility,” explains David Silsby, Enterprise Sales Director for Network Utilities, “With our new monitoring as a service offering, we have looked at what SME’s really require and created a product that is extremely cost effective and allows the customer to pay for what they need and scale up as they grow – without skimping on crucial elements such as skilled support staff or customer service.”

The service includes flexible notification and escalation that can be setup for contact via phone or email, with a tailored dashboard to allow clients to view all monitored devices in real time, supported by monthly reports detailing the overall health of the network and attached IT infrastructure. Every client also gains a dedicated account manager that helps manage the service while providing guidance on wider networking and security challenges.

Come on down to stand A9 and you could be the winner of an Amazon voucher or an awesome Apple watch.

Register to attend IP EXPO here

We look forward to seeing you there.

Identity Centric Networks & Security

Identity Matters. We specialise in identity-centric network and security solutions. Understanding who is on your network, what they want to access, and how, allows us to deliver the best possible solutions to your business challenges. We partner with industry-leading technology vendors to ensure your network is fast, secure and highly-optimised.