Threat Watch

Whaling Gets Real

Powered by social-networking sites and compromised corporate databases, super-targeted phishing attacks are moving from theory to practice. Here's how to understand this evolving information-security threat and protect your company and its executives

By Rick Cook

someone you know, mail them back and ask what they’re sending," Stewart says. "You’ve really got to be suspicious of these types of messages that seem to come from an authority figure. In that sense we have an easier job in user education. It comes to security team having a meeting of the executive team [and saying,] Be suspicious of anything you get. Run it by us."

Paller, however, warns that "education" in the form of seminars and lectures doesn’t work well in the long run; in fact, he says, it hardly works at all. Instead, he suggests a process he calls "inoculation," which involves repeatedly sending out fake whaling-type messages. "When [the user bites], [he or she] gets a message saying, ’Oops, you’ve just been had.’ You do that over and over again until people learn.”

Rick Cook is a freelance writer based in Phoenix.

--

The comment field below does not work. Please send your feedback to csoletters@cxo.com.

Other stories by Rick Cook

• Email
• Print
• Comments
• Digg This
• SlashDot

• Death to Phishing
• Phishing: The Basics
• Latest Scams, Traps and Phishing Attempts