Finding the Phish in Your Firm’s Pond

It’s Friday afternoon, and you’re planning to leave early and get a jump start on your weekend. You receive an email with the subject “Office 365 – Failed Login Attempts – Password Reset Required Immediately!” You wonder who tried to access your account or whether you forgot to logout of your email on the public computer at the hotel business center. You were all but out the door when out of an abundance of caution, you decide you should probably reset your password; otherwise you’ll think about it all weekend. The email looks legitimate. You click the link and a familiar page opens in your browser. Everything looks as expected – the logos are there, the web address looks convincing, and the general layout of the site leads you to believe this is a legitimate website. You enter your username, your old password, and you carefully select a new, even more complex password and click the button to reset your password. The problem is, in your haste to get out of the office early you just clicked a link in a fraudulent email. The credentials you just entered on that website? They were just sent to a hacker who can now access your company’s network masquerading as you. You just fell victim to a phishing attack, and unfortunately, you’re not alone.

What is Phishing?

Phishing is a form of social engineering where an attacker with malicious intent attempts to trick a target into performing an action such as clicking a link, providing credentials, or opening an infected file. Targets are often tricked into disclosing private or sensitive information by someone impersonating a trusted source such as a bank or credit card company, an authoritative source such as a government agency, or by appealing to a target’s willingness to help by impersonating a colleague, supervisor, or client. In one of the more successful methods of phishing, attackers send emails to company staff purporting to be from company executives.

Want to read more?

Fill in the form below to download the full article.

Loading form...

Mike Farrell, CISA, CISM – CSS Cyber IT Services

Latest Content

Introduction to SFTR ‘Cheat Sheet’

SFTR is designed to enhance transparency of Securities Finance Transactions (SFTs) for all financial and non-financial EU entities and, branches of non-EU entities. The reporting obligation begins 11 April 2020 for investment firms, followed by a nine-month phased approach for other firms. Need a quick introduction to the key details of the regulation? Download our … Continued

Even When SEC Rulemaking Slows, Your Compliance Manual Shouldn’t Stagnate

Maintaining tailored policies and procedures is a critical component of an adviser’s internal controls. Time and time again, we’ve heard regulators admonish the industry that off-the-shelf compliance manuals just don’t cut it. In today’s ever-shifting regulatory environment, does your compliance manual need a reboot? Although there has not been any significant rule making over the … Continued

Life Cycle Guidance for Service Provider Due Diligence

Engaging third-party service providers to perform key functions can offer an investment adviser access to state-of-the-art technology and solutions necessary to compete in today’s environment. Before entering into service provider relationships, advisers need to understand that while the function may be outsourced, the responsibility for the function still rests with the adviser. Firms engaging service … Continued