In November 2017, hackers sent out spear phishing emails specifically targeting employees who handled their companies’ finances. To trick the employees into falling for the scam, they made the emails appear to be from trusted business associates. Learn more about this spear phishing attack and how to protect your business from this type of scam.

In November 2017, security researchers discovered a new spear phishing email campaign targeting employees who handled their companies’ finances. The cybercriminals masqueraded as business contacts the employees knew and trusted. To trick an employee into thinking the email came from a trusted business associate, they spoofed the name that appeared in the “From” field so that it showed the associate’s name.

The emails’ context varied, but they all mentioned invoices. For example, the subject line of one email noted that an invoice was due. The email’s message read, “I tried to reach you by phone today but I couldn’t get through. Please get back to me promptly with the payment status of this invoice below.” The message included a link for the recipient to click to see the invoice.

In another case, the email’s subject line mentioned an address update, but the message also alluded to an invoice. The message read, “I’m providing you with my new address and invoice details below.” The message included a link for the recipient to click to get the new address and invoice.

In both cases, the email itself was harmless and could simply be deleted. However, if the email recipients clicked the link, they triggered a cyberattack.

This email campaign highlights an important characteristic of spear phishing attacks: Companies are usually the target. Therefore, it is important to take measures to protect your business from this type of scam. One way is to use a three-phase approach.

Phase 1

Employees cannot fall for spear phishing scams if the emails never reach their inbox. Thus, you should try to prevent as many malicious emails as possible from reaching your employees by keeping your company’s email filtering and anti-malware tools up-to-date. You might even consider getting an email security solution designed to catch spear phishing and other types of malicious emails.

Another preventive measure is to make your company harder to target. Cybercriminals often obtain the information they need to personalize spear phishing emails from company websites and social media networks. So, it is a good idea to make sure that potentially sensitive information (e.g., employees’ email addresses and job titles) is not publicly available on your company’s website or social media pages. You might even consider implementing a social media policy that provides guidance on the types of company-related information employees should avoid posting on their personal social media pages.

Phase 2

Despite your efforts to prevent spear phishing emails from reaching employees’ inboxes, some will likely make it through. For this reason, it is important to educate employees on how to spot these scams. Common signs include:

• Spoofed name in the “From” field
• A deceptive URL (the actual URL does not match the displayed linked text or web address)
• An email attachment
• The sender tries to get the recipient to perform an action (e.g., click a link or open an email attachment)

When discussing spear phishing scams with employees, you should stress the importance of not clicking links in emails, even if the emails appear to be from people they know. You should also show them how to check for deceptive URLs and spoofed names in the “From” field. If the URL or email address seems suspicious, have them call the email’s sender to make sure the person sent it.

Phase 3

Cybercriminals are becoming more skilled at creating spear phishing emails, so employees still might fall for a scam, even if they know the basics on how to spot one. Therefore, it is best to take measures that will help mitigate the effects of a successful attack. One effective measure is to regularly perform backups and test the backup files. Having restorable backup files ensures that you won’t lose your data or have to give into a cybercriminal’s ransom demand if a successful spear-phishing scam leads to ransomware or another type of malware infection.

Develop a Plan of Action

The specific steps required in each phase will vary depending on the security measures already in place in your company. We can assess your security defenses and help you develop an action plan. We can also provide recommendations on how to protect your business from other types of malicious attacks.

If you take advantage of Google’s many services, you undoubtedly have a large amount of data stored on its servers. But having a local copy of your data is convenient in case you need to work offline. Here is how to create an archive of your Google data.

When you sign up for a Google account, you get access to many services, such as Gmail, Contacts, and Google Drive. Upon activation, each of these services will rapidly start accumulating large amounts of data on Google’s servers, especially if you use the services for work. However, you won’t be able to access any of your information if you need to work offline.

Creating an offline copy, or archive, of your Google data is a good way to get around this problem. An archive is also useful if you want to export your bookmarks to a different web browser, or if you accidentally delete something in Gmail or Google Drive. Plus, it can be a good idea to create an archive of your data if you decide to delete your Google account. Once deleted, you won’t be able to retrieve your data from the company’s servers.

Google’s archiving tool is full-featured. Within the tool, you can select the data you want to archive from more than 15 Google services, including Gmail, Google Drive, Calendar, Contacts, Bookmarks, Google Photos, and Google searches.

The archiving tool is also easy to use. Just follow these steps:

1. Go to Google’s Download your data web page.
2. Sign in to your account.
3. Review the list of services from which you can archive data. Initially, all of them will be selected, but you can clear the check boxes of the ones you do not want to include in your archive.
4. Check to see if the items you selected have a small arrow next to them. If so, click it to reveal options available to you. For instance, clicking the “Contacts” arrow reveals that you can choose to save your contact data in vCard, HTML, or comma-separated values (CSV) format.
5. Click “Next”.
6. Choose the file format (ZIP, TGZ, or TBZ) for your archive using the “File type” option. Generally, a ZIP file is the preferred format as it can be opened on almost any computer with no additional software.
7. Select the maximum size for the archive in the “Archive size (max)” drop-down list. There are a variety of options ranging from 1 to 50 gigabytes. If your archive is larger than the size you specify, Google will split it into multiple files.
8. Using the “Delivery method” option, indicate how you want the archive to be delivered. You can choose to receive an email that includes a download link or have the archive sent to Google Drive, Dropbox, or Microsoft OneDrive.
9. Click “Create archive”.

Archiving large amounts of data can take hours or even days to complete, so Google will send you an email when your archive is ready.

Data backups and replication are not referring to the same thing. Discover how they differ so that you can determine whether your business needs only one solution or both of them.

Data backups and replication aren’t one and the same. There are important differences in what they are used for and how they are set up. Only by understanding the differences can you determine whether your business needs just one solution or both of them.

Data Backups

Data backups involve copying both critical and non-critical data periodically. They are typically performed once a day, but it can be more or less often, depending on a company’s needs.

Once created, the backup files are stored on a storage device, which can be located onsite, offsite (e.g., online, at a company facility in a different part of the country), or both. However, only storing the backup files onsite is not ideal. If a natural disaster such as a flood or tornado strikes, both the original data and the backup files could be destroyed.

It is relatively inexpensive to perform and store data backups. Plus, they are well suited for compliance with government and industry regulations, as the backup files can be kept for as long as needed. However, data backups do not ensure continuity of operations if there is a disaster or system failure since it can take a while to set up a new system and restore the data from the backup files.

Replication

Replication involves copying and moving data to a secondary system, usually in near real-time. Replication is typically used for critical data that must always be available.

The replicated data is kept in an offsite secondary system, which is identical to the primary system. As soon as a change is made to the data on the primary system, it is permanently made to the data in the secondary system. As a result, there are no recovery points, which can be problematic. For example, if ransomware encrypts the data on the primary system, the encrypted data will be copied and moved to the secondary one. You can, however, combine replication with continuous data protection or snapshot technology to create recovery points to roll back to.

Replication solutions are designed to ensure that critical data and the applications used to work with that data are always available if there is a system failure or disaster. However, setting up and maintaining a replication solution can be expensive because the secondary system needs to be identical to the primary system.

What Should You Use?

Data backups and replication address different types of risks. Backups ensure that a business can recover its data after a system failure or disaster (disaster recovery), while replication ensures that critical data and applications are available for use if the primary system goes down (high availability).

Every business needs to be backing up its data regularly as well as making sure it can restore its data from those backups. A business might also need a replication solution if it has critical data and applications that always need to be available. If recovery points are created, the secondary system could serve as a backup mechanism for the critical data. However, a data backup solution would still be needed for the business’s non-critical data.

We can help you determine whether you need one or both solutions in your business.

Fileless attacks are on the rise. However, many people are unfamiliar with them. Learn what they are and how to protect your business from them.

Fileless attacks are not new, but they are becoming more common. Thirty-five percent of all cyberattacks in 2018 will be fileless, according a Ponemon Institute study. But what are they? Here is what you need to know about fileless attacks and how to protect your business from them.

Fileless Attacks 101

A fileless attack is not a new type of malware or the latest digital scam. Instead, it is a descriptor for a specific type of attack. In traditional cyberattacks, hackers try to install and run malware from a device’s hard disk. In fileless attacks, cybercriminals run malware directly from a computer’s memory. Hackers often use these in-memory attacks to steal money or data. The largest data breach in 2017 — the Equifax data breach — was a fileless attack.

Fileless attacks begin like most other cyberattacks. Cybercriminals try to gain access into a computer system. They might try exploiting a security vulnerability in unpatched software or try using a brute force attack to crack the password of service account. A more common technique, though, is sending out phishing emails that try to trick people into clicking a malicious link or opening a malicious attachment, such as a Microsoft Word document containing a macro.

Once the hackers have gained access, they run commands or malware directly from the computer’s memory. They often take advantage of built-in system administration tools such as Windows PowerShell or Task Scheduler to run commands and malware.

Fileless attacks are not necessarily fileless at every stage. The attack might initially begin in-memory, but then hackers will install malware on the hard disk, or vice versa.

Why Fileless Attacks Are Becoming More Common

Hackers are increasingly turning to fileless attacks because they are 10 times more likely to succeed than file-based attacks, according to the Ponemon Institute study. The high rate of success can be attributed to several factors.

For starters, anti-virus software is not very effective in detecting fileless attacks because malware is often not present on computers’ hard disks. Forensics experts also have a more difficult time reconstructing attacks for the same reason. Knowing how cybercriminals carried out attacks helps prevent similar attacks in the future.

Another reason for the high success rate is that fileless malware is often designed to run in stealth mode, which makes it harder to detect. Plus, hackers usually take advantage of built-in system administration tools to carry out tasks in-memory. Using built-in tools raises fewer red flags because system administrators often use them for legitimate work, making it more difficult to spot anomalies. In addition, access to those tools cannot be completely blocked since administrators need to use them.

How to Protect Your Business

Although fileless attacks have a high rate of success, you are not helpless against them. To protect your business, you can:

• Make sure that computers’ operating system software, applications, and firmware are updated so that known security vulnerabilities are patched. Unpatched software can provide cybercriminals with an entry point into a computer.
• Educate employees about phishing emails and the dangers of clicking links in emails and opening files attached to them. Hackers often use phishing emails to initiate cyberattacks, including fileless attacks.
• Make sure macros are disabled in Microsoft Office apps like Word and Excel. Macros can be used by cybercriminals to access computers.
• Use strong passwords for system and service accounts. Hackers can crack a weak password in minutes with a brute-force password-cracking tool.
• Disable system administration tools not being used. That way, cybercriminals won’t be able to take advantage of them. It is particularly important to disable is PowerShell, as it is frequently used by hackers in fileless attacks.
• Block suspicious activities. For example, you might want to stop any outbound process trying to connect to untrusted servers or websites.

We can evaluate your business and provide specific recommendations on how to secure it against fileless attacks.