Threat Intelligence Blog
Contact us to discuss any insights from our Blog, and how we can support you in a tailored threat intelligence report.
What is the CIA Triad? Find out in our Tip Tuesday video explainer series
What is the CIA Triad? Find out in our Tip Tuesday video explainer series
Tip Tuesday Explainer series
Phishing, Spear-Phishing, Whaling and Business Email Compromise (BEC) explained - Cyber Tip Tuesday
Welcome to this week's Black Arrow Cyber Tip Tuesday, this week Bruce is talking about Phishing emails including Business Email Compromise or BEC.
Many of you will be familiar with receiving phishing emails that, for example, encourage you to click a link to unblock your PayPal account, or encourage you to respond to an urgent message.
Although you still see that type of email, they are being replaced by much more sophisticated versions that are addressed specifically to you. These encourage you, by name, to look at an attached document or to contact the sender for a private discussion.
If you click on the attachment it will try to download malware, or if you reply to the sender then you will be starting a correspondence that will likely lead to you being duped into a later harmful activity. These personalised types of emails are called spear phishing, and they have become more prevalent because the software to create them is more easily available online and so they require less work by the attacker.
A variation of spear phishing is when the attacker targets the senior leadership in an organisation because those targets have more valuable information on their computer, and they are likely to have more wealth to exploit. This is called whaling, and again they take a bit more effort on the part of the attacker, but the rewards can be greater.
Another type of email attack is called Business Email Compromise, or BEC.
In this case, someone’s email account is broken into, and the attacker monitors the emails while the email owner is unaware. Then, at an opportune moment, the attacker will send an email to the victim with an instruction such as to use alternative bank account details for a payment. The payment goes straight to the attacker instead of the correct recipient, and the victim does not find out until it is too late.
You cannot rely on technology to stop these kinds of attacks.
You need strong people controls, where everyone should be suspicious of email and aware of the types of possible attacks.
The best thing to do is to contact the supposed sender of the email to ask them to confirm that they sent you that email before you open it. And if you are suspicious of an email from someone you do not know and you cannot contact them, then you might want to delete it; if it is a genuine email then the sender can contact you again.
If you'd like to know more about how you can protect yourself or your company, have a look at the information on our site, blackarrowcyber.com, and contact us to see how we can help you.
Welcome to this week's Black Arrow Cyber Tip Tuesday, this week Bruce is talking about Phishing emails including Business Email Compromise or BEC.
Many of you will be familiar with receiving phishing emails that, for example, encourage you to click a link to unblock your PayPal account, or encourage you to respond to an urgent message.
Although you still see that type of email, they are being replaced by much more sophisticated versions that are addressed specifically to you. These encourage you, by name, to look at an attached document or to contact the sender for a private discussion.
If you click on the attachment it will try to download malware, or if you reply to the sender then you will be starting a correspondence that will likely lead to you being duped into a later harmful activity. These personalised types of emails are called spear phishing, and they have become more prevalent because the software to create them is more easily available online and so they require less work by the attacker.
A variation of spear phishing is when the attacker targets the senior leadership in an organisation because those targets have more valuable information on their computer, and they are likely to have more wealth to exploit. This is called whaling, and again they take a bit more effort on the part of the attacker, but the rewards can be greater.
Another type of email attack is called Business Email Compromise, or BEC.
In this case, someone’s email account is broken into, and the attacker monitors the emails while the email owner is unaware. Then, at an opportune moment, the attacker will send an email to the victim with an instruction such as to use alternative bank account details for a payment. The payment goes straight to the attacker instead of the correct recipient, and the victim does not find out until it is too late.
You cannot rely on technology to stop these kinds of attacks.
You need strong people controls, where everyone should be suspicious of email and aware of the types of possible attacks.
The best thing to do is to contact the supposed sender of the email to ask them to confirm that they sent you that email before you open it. And if you are suspicious of an email from someone you do not know and you cannot contact them, then you might want to delete it; if it is a genuine email then the sender can contact you again.
If you'd like to know more about how you can protect yourself or your company, have a look at the information on our site, blackarrowcyber.com, and contact us to see how we can help you.
What is a Brute Force attack - Cyber Tip Tuesday Explainer Series
This week's Black Arrow Cyber Tip Tuesday video explains Brute Force Attacks as part of our video explainer series, introducing key terms and concepts to help you understand the threats and risks facing your business.
This week's Black Arrow Cyber Tip Tuesday video explains Brute Force Attacks as part of our video explainer series, introducing key terms and concepts to help you understand the threats and risks facing your business.
What is the Functionality, Usability and Security triangle?
What is the Functionality, Usability and Security triangle?
We explain one of the core concepts of information security, the functionality, usability and security triangle - and explain why getting the balance between the three points is so important
We explain one of the core concepts of information security, the functionality, usability and security triangle - and explain why getting the balance between the three points is so important
What is the CIA Triad? You're probably heard it mentioned but what is it, and why do you need to know it - Cyber Tip Tuesday video
What is the CIA Triad?
In any conversation you may have been involved in relating to cyber or information security you may have heard reference to the 'CIA triad' - but what exactly is it? And why you need to know what it represents
What is the CIA Triad?
In any conversation you may have been involved in relating to cyber or information security you may have heard reference to the 'CIA triad' - but what exactly is it?
And why you need to know what it represents
Social Engineering Terms Explained - Part 2 - Cyber Tip Tuesday video
Social Engineering Terms Explained - Part 2
Social Engineering Key Terms explained - Phishing, Spear-Phishing, Whaling and more - Cyber Tip Tuesday video
Social Engineering Key Terms explained - Phishing, Spear-Phishing, Whaling and more - Cyber Tip Tuesday video
Key InfoSec Terms and Concepts - Vulnerabilities, Threats, Risks and Countermeasures
Key InfoSec Terms and Concepts - Vulnerabilities, Threats, Risks and Countermeasures
What is MDM? The first of a new series explaining different technical controls, in this episode James explains Mobile Device Management
Welcome to this week's Cyber Tip Tuesday. This week James is doing the first of a series looking at specific technical controls, this week Mobile Device Management, or MDM You may have heard of MDM…but what is it? Mobile Device Management is the technology used to administer mobile devices such as phones, tablets and laptops. Because these devices often run across platforms provided by different vendors, for example, Apple's iOS, Google's Android or Microsoft Windows they must be managed by a product that is compatible with all of them. If your company's confidential data is stored or accessed on any of these devices then it is important that you extend your technical controls to encompass the unique security requirements and vulnerabilities that can be exploited to gain access to it. If you'd like to know more about MDM or other technical controls, please contact us.
Welcome to this week's Cyber Tip Tuesday.
This week James is doing the first of a series looking at specific technical controls, this week Mobile Device Management, or MDM
You may have heard of MDM… but what is it?
Mobile Device Management is the technology used to administer mobile devices such as phones, tablets and laptops. Because these devices often run across platforms provided by different vendors, for example, Apple's iOS, Google's Android or Microsoft Windows they must be managed by a product that is compatible with all of them.
If your company's confidential data is stored or accessed on any of these devices then it is important that you extend your technical controls to encompass the unique security requirements and vulnerabilities that can be exploited to gain access to it.
If you'd like to know more about MDM or other technical controls, please contact us.