KnowBe4 Security Awareness Training Blog

CyberheistNews Vol 3, 20

Editor's Corner

Latest Attack Trend: 'Persistent Spear Phishing' DarkReading had an article a few weeks ago: 'How Hackers Fool Your Employees' that was very interesting to read. What caught my eye were two quotes from thought leaders in our security training space: Lance Spitzner from SANS and Rohyt Belani from PhishMe. Lance Spitzner, training director for the Securing The Human Program at SANS Institute said: "Computers store, process and transfer information, and people store, process and transfer information," he says. "They're another endpoint. But instead of buffer overflows, people suffer from insecure behaviors." Rohyt Belani, CEO of security training firm PhishMe observed something interesting. He said: "Conversational phishing is the latest attack trend. The victim gets multiple emails that make it look like there's a human on the other end and that it's part of an email thread,". The attacker knows enough about the victim and his interests to convince him that, say, they had met at a busy convention such as RSA. "From there, the attacker tells the victim about a blog post that he'd surely be interested in and attaches an infected version. The attacker even sends a follow-up message asking the user if he had a chance to look at the blog. "Now you're subconsciously convinced that it's a real human being so you open that document," Belani says. "The bad guys have been doing that for at least the last six months." That's why I call it 'PSP' for Persistent Spear Phishing but the concept is clear. It's ultimately a human attacking a human via the Internet, either through a single email or a logical sequence of emails that can easily be automated. Here is the whole article, which ends with two VERY interesting graphs you should definitely check out! http://www.darkreading.com/end-user/how-hackers-fool-your-employees/240152770? I also created a page at Wikipedia for this new term, and you are welcome to go there and improve upon my first attempt to describe it: http://en.wikipedia.org/wiki/Persistent_Spear_Phishing Do This Phishing IQ Test! Did you know that SonicWall has an interesting Phishing IQ test on their website? Its a few years old but actually fun and interesting to do. You get a series of 10 emails and you need to indicate if it is a phishing attack or if it's legit. Go ahead and test if you get them all correct. At the end they have an explanation for each why it's either a scam or legit. Here you go and have fun!: http://www.sonicwall.com/furl/phishing/ Quotes of the Week "The winner's edge is not in a gifted birth, a high IQ, or in talent. The winner's edge is all in the attitude, not aptitude. Attitude is the criterion for success." - Denis Waitley "An intelligent person is never afraid or ashamed to find errors in his understanding of things." - Bryant H. McGill "The true sign of intelligence is not knowledge but imagination." - Albert Einstein Thanks for reading CyberheistNews! But if you want to unsubscribe, you can do that right here You can read CyberheistNews online at our Blog!: http://blog.knowbe4.com/bid/277956/CyberheistNews-Vol-3-19

Thanks for reading CyberheistNews! Warm Regards, Stu Sjouwerman | Email me: feedback@knowbe4.com To unsubscribe please click here

Stop Phishing Security Breaches

Your end-users are the weak link in your network security. Today, your employees are frequently exposed to advanced phishing attacks, and over 90% of data breaches start with a phishing attack.

IT Security specialists call it your 'phishing attack surface'. The more email addresses that are exposed, the bigger your attack footprint is, and the higher the risk. It's often a surprise how many of your addresses are actually out there, and who's.

Find out now which of your email addresses are exposed. The Email Exposure Check (EEC) is a one-time free service. KnowBe4 customers with a Gold package get an EEC sent to them regularly so they can address the issues that are found. An example would be the email address and password of one of your users on a crime site. Fill out the form and we will email you back with the list of exposed addresses. The number is usually higher than you think.

Sign Up For Your Free Email Exposure Check Now:
http://info.knowbe4.com/free-email-exposure-check-0-1-2

Four Ways To Defeat APT

Advanced Persistent Threats (APT) are essentially industrial espionage by nation-states. Several of these APT's are supported by their military (like China and Iran) and go after both civilian and military targets. APT really is a team of skilled hackers that have been given a target like Boeing and work day and night to penetrate that account.

Obviously cyber-espionage can be used for two things: 1) Exfiltrate intellectual property for competitive purposes, 2) Discover weak spots in a nation's critical infrastructure and use these for cyberwar (disruption).

This is the 30,000 feet perspective of what needs to be done. First you need to filter ingress, but also filter egress at the same time, then you analyze your network for hacker intrusions, and last but not least, you need to step your users through security awareness training. The filtering can be done with existing software layers. The analysis is a job for died-in-the-wool security researchers that dig into all your log files, the registry and other data. You know where to go for the training.

10 Classic Hacking, Phishing And Social Engineering Lies

Whether it is on the phone, online or in person, here are ten lies hackers, phishers and social engineers will tell you to get what they want. It might be an idea to send this link to your employees and let them step through these reminders as they are still used every day:
http://www.csoonline.com/slideshow/detail/91543/9-classic-hacking--phishing-and-social-engineering-lies?

Federal CIO's Awareness Training Survey Results

TechAmerica, the trade group representing IT manufacturers released some interesting survey results this month. Of the U.S. Federal CIOs about 40 percent contend security awareness training is effective or very effective; only 8 percent rate it as ineffective. Half of them are neutral and I am sure that's because they have done it simply for compliance reasons only, and old-style - coffee and donuts in the break room and death by powerpoint.

One government agency phished its own employees, and nearly one in five receiving a tainted e-mail took the bait. "Those who fell for it were directed to a page and told they had been phished," the CIO says. "Then we provided some on-the-spot training and education. The reaction was actually very positive."  More:
http://www.techamerica.org/Docs/CIO%20Survey_May%202013_v4.pdf

Cyberheist 'FAVE' LINKS:

* This Week's Links We Like. Tips, Hints And Fun Stuff.

PURE CAR LUST! A Lamborghini Aventador, McLaren MP4-12Cs, Porsches, Astons, Lotuses, Ferraris, Noble M12, V10 BMW M5, Audi R8, Nissan GT-R and Maserati GranTurismo Convertible accelerating onto a highway on their way home from a charity drive:
http://www.flixxy.com/50-supercars-accelerating-onto-a-motorway.htm

An epic journey on the exciting Pan American route from Alaska to Argentina: 503 days - 82,459 miles - 22 countries - 1 man:
http://www.flixxy.com/modern-motorcycle-diaries-alaska-to-argentina.htm

Top Gear takes an Aston Martin DBS Volante, a Ferrari California, and a Lamborghini Gallardo LP560-4 Spyder in search for the world's greatest driving road:
http://www.flixxy.com/the-greatest-driving-road-in-the-world-transfagarasan-romania.htm

To succeed against the powerful car lobby in 1901, Henry Ford challenges the champion driver Alexander Winton to the famous "Race That Changed the World.":
http://www.flixxy.com/1901-race-that-changed-the-world.htm

The Craziest Windows 8 Ads Ever Made. These ads are for the Japanese market and they are outright WEIRD:
http://winsupersite.com/windows-8/craziest-windows-8-ads-ever-made

There are no words to describe Miyoko Shida's performance for the Spanish TV program "You Can Do It.":
http://www.flixxy.com/the-incredible-power-of-concentration-miyoko-shida.htm

Martin and Marielle launch into a series of awesome moves at the "Britain's Got Talent 2013" auditions:
http://www.flixxy.com/martin-and-marielle-astound-with-their-dancing.htm

A dash cam compilation from Russia that will renew your faith in human kindness:
http://www.flixxy.com/russian-dash-cam-compilation-proves-the-world-is-full-of-good-people.htm

Quadruped Robot walks of four legs, rolls on four treads. Crafty:
http://hackaday.com/2013/05/04/quadruped-walks-of-four-legs-rolls-on-four-treads/

Is Your Business Using the (Ethical) Science of Persuasion?:
http://www.risingabovethenoise.com/is-your-business-using-the-ethical-science-of-persuasion/

Robotic insects make first controlled flight:
http://youtu.be/cyjKOJhIiuU

A tall girl on a series of dates in her quest to find the perfect partner:
http://www.flixxy.com/volkswagen-tall-girl.htm

CyberheistNews Vol 3, 19

Editor's Corner

Fraud-as-a-service Goes Mainstream Researchers at RSA stumbled upon a Facebook page that had been up for several months, and was marketing the Zeus banking Trojan. This is something new as up to now, this type of marketing was limited to the 'darknet' criminal underground. The Facebook page has been taken down but Trojans being sold out in the open with 'hints and tips' how to steal credit cards shows that cybercrime is going mainstream. RSA's Limor Kessem said: "Social networks are such a great place for malware infections and phishing, why not just market the botnet directly from there?" Full article over at BankInfoSecurity: http://www.bankinfosecurity.com/facebook-used-to-market-banking-trojans-a-5714? Scam Of The Week: Mother's Day Cybercrime has their yearly campaigns carefully mapped out just like real internet marketers. The first Mother's Day scams are sticking up their ugly heads, and they usually start off with: "Don't Forget Mother's Day - $19.99 Flowers". Once you click on the link, you get to a website with all kinds of potential presents, but if you buy these, the only present you give is your credit card information for free to the bad guys. Other Mother's Day scam sites promote jewelry, designer clothing and shoes. Send your users a quick heads-up and tell them to browse for gifts only at sites they know and are reputable! Yahoo Warns: "Your Small Business May Have Already Been Hacked" Veteran IT reporter Dan Tynan has a very popular Yahoo SMB column. He interviewed me and I was quoted in his April 25 article about hacking. There is a lot of good ammo in there if you need (to increase) IT security budget: "While attacks on large enterprises have declined slightly over the last year, threats to SMBs have risen sharply. Cyber attacks targeting businesses with 250 employees or less doubled in the first six months of last year, according to Symantec. The average loss per attack: more than $188,000." "One of the biggest fallacies about small-to-medium businesses is that they're too small to be noticed by hackers,” he says. “That's simply not the case.” In fact, for SMBs the opposite is true. Here is the article: http://smallbusiness.yahoo.com/advisor/warning--your-small-business-may-have-already-been-hacked-183345805.html Quotes of the Week "You get the best out of others when you give the best of yourself." - Harvey S. Firestone "If you want something done, ask a busy person to do it. The more things you do, the more you can do." - Lucille Ball Please tell your friends about CyberheistNews! They can subscribe here: http://www.knowbe4.com/cyberheist-news/ You can read CyberheistNews online at our Blog!: http://blog.knowbe4.com/bid/268774/CyberheistNews-Vol-3-19

Thanks for reading CyberheistNews! Warm Regards, Stu Sjouwerman | Email me: feedback@knowbe4.com To unsubscribe please click here

Stop Phishing Security Breaches

Your end-users are the weak link in your network security. Today, your employees are frequently exposed to advanced phishing attacks, and over 90% of data breaches start with a phishing attack.

IT Security specialists call it your 'phishing attack surface'. The more email addresses that are exposed, the bigger your attack footprint is, and the higher the risk. It's often a surprise how many of your addresses are actually out there, and who's.

Find out now which of your email addresses are exposed. The Email Exposure Check (EEC) is a one-time free service. KnowBe4 customers with a Gold package get an EEC sent to them regularly so they can address the issues that are found. An example would be the email address and password of one of your users on a crime site. Fill out the form and we will email you back with the list of exposed addresses. The number is usually higher than you think.

Sign Up For Your Free Email Exposure Check Now:
http://info.knowbe4.com/free-email-exposure-check-0-1

FAQ: Phishing Tactics And How Attackers Get Away With It

Network World reported: "Phishing attacks on enterprises can be calamitous in terms of compromised networks or damaged brand names, and the Anti-Phishing Working Group (APWG), which aggregates and analyzes phishing trends data worldwide, offers some of the best insight from industry into what's occurring globally in terms of this cybercrime. The following list of frequently asked questions about phishing is derived from the APWG's April report that covers the period July-December 2012 worldwide:
http://www.networkworld.com/news/2013/042913-apwg-269219.html?

What Do Spear-Phishing Emails Have To Do With Drones?

It begins its infiltration, as so many attacks do, with spear-phishing emails – in this recent case, those mentioning drone tech. There is an Advanced Persistent Threat coming out of China that tries to uncover anything it can about Drones. Imagine they are able to hijack one of those and use it against ourselves for real. No longer the stuff of movies only... http://www.infosecurity-magazine.com/view/31961/fresh-operation-beebus-attack-targets-military-drone-technology

Why We Need Security Awareness Training Programs

I found a great article by Kai Roer, Senior Partner at the Roer Group.

"Lately, some of the smartest people in Infosec decided that security awareness trainings are a waste of time. Last out is Bruce Schneier, who decided to speak up against awareness training.

"The claim that security awareness trainings are not working is, in my opinion, a claim based on wrong assumptions. It also shows a clear lack of understanding of the inner workings of the human mind, and a total lack of respect for your co-workers.

"If all you focus on is technology, code and cryptology, and you have very little real interaction with people, I can understand where you are coming from. It takes more than code to decrypt the subtleness of human interaction." He continues with a clear cut case for training that I think you will enjoy: http://www.net-security.org/article.php?id=1833&p=1

The 7 Elements Of A Successful Security Awareness Program

Ira Winkler and Samantha Manke wrote: "When we were asked to keynote a recent CSO event, it was a pleasant surprise that the top concern of the CSOs was "security culture." From performing many security assessments and penetration tests, it is sadly obvious that even the best technical security efforts will fail if their company has a weak security culture.

"It is heartwarming that CSOs are now moving past straight technological solutions and moving towards instilling a strong security culture as well. To determine the components of a truly successful security awareness program, we performed a study to identify critical success factors for building one. We interviewed security awareness practitioners at Fortune 500 companies and surveyed the security staff and general employees at the companies. Additionally, we validated the results and gathered additional information at a security executive event in the United Kingdom with more than 150 security executives participating.

"While there are many more lessons to be learned, what follows are the 7 most notable habits we found that lead to successful security awareness programs." Here they are!
http://www.csoonline.com/article/732602/the-7-elements-of-a-successful-security-awareness-program?

Cyberheist 'FAVE' LINKS:

* This Week's Links We Like. Tips, Hints And Fun Stuff.

Tech columnist David Pogue shares 10 simple, clever tips for computer, web, smartphone and camera users. (Believe it or not, I didn’t know about the spacebar scroll…) Great tips!
http://www.flixxy.com/10-top-time-saving-tech-tips.htm

"If anyone knows any reason why these two should not be married, speak now or forever hold your peace" LOL:
http://www.flixxy.com/surprise-at-a-wedding.htm

Spring is in the air and it is in Ultra High Definition. Just select "Original" in the resolution menu to view it in 4K HD:
http://www.flixxy.com/spring-is-in-the-air-in-ultra-high-definition-4k-hd.htm

Tigers, lions and leopards love boxes too! Just like domestic cats!
http://www.flixxy.com/big-cats-like-boxes-too.htm

Check out the ad for the Nokia Lumia 920, one of the latest Windows 8 handsets. Pretty funny actually:
http://www.youtube.com/watch?feature=player_embedded&v=Z19vR1GldRI

How does money come into existence and how does it work? Very interesting:
http://www.flixxy.com/how-much-money-is-there-on-earth.htm

This fully automated printing and filing system was discovered by accident when the staff at a college noticed printouts disappearing mysteriously. You cannot make this up:
http://www.flixxy.com/amazing-printer-filing-system.htm

UK Counter Espionage and Big Biz team up against cyber attacks. The new team is called 'Fusion Cell'. Here is the video:
http://outsidelens.scmagazine.com/video/Cyber-Threat-Spies-And-Big-Firm

Got Kids interested in Robots? This kit provides a solar powered robot they can configure in 14 different modes. Actually pretty cool, see the video they have on this page. And only 30 bucks...
http://www.owirobot.com/14-in-1-educational-solar-robot-kit/

The Netherlands Opera staged a Flash mob in an Amsterdam department store with "Let's drink from the joyful cup" from Giuseppe Verdi's opera La Traviata:
http://www.flixxy.com/verdi-la-traviata-flashmob-in-amsterdam.htm

There is no way you have ever seen skills like these with a remote control helicopter. This guy is amazing:
http://www.flixxy.com/astounding-rc-helicopter-flying.htm