It is a warm summer day and the ice cream shop down the block sends out a coupon link for 50% off a pint of your choice to your office. The coupon link comes from the reception desk email from your office building. To receive the offer, you click the link and pull it up on your phone’s mobile browser to show it at the register. How many of your staff are going to question whether it’s legitimate? How long until the ice cream shop clerk says it’s not legitimate? By the time word spreads of the scam, employees have opened a malicious link that can lead to a network breach.
It sounds complicated, but here’s how easy it is to pull off. One custom T-shirt printed with the ice cream shop logo and a friendly, five-minute conversation at the front desk makes the attacker appear trustworthy enough to offer a deal to your coworkers. The attacker asks the front desk receptionist to send out an email of their digital coupon since they don’t have a way to send it to everyone in the building. The message is now coming from a trusted source about a known, local ice cream shop offering a deal. It’s also likely the front desk receptionist doesn’t know the URL of the ice cream shop’s website (if they even have one), making it easier to spoof. A URL— provided by the attacker—is given to the front desk to forward on and the office is thanked on behalf of the shop owners —whose names are on social media. The attacker leaves and heads off to the next building. How nice of them to take the time to stop and offer a sweet deal to your office!
There are many layers to the security onion, and not all of them can be put in place with hardware or software. Diligence on procedures and training are critical. That is why CCI Systems has partnered with FRSecure to assess your security posture as the outside “Red Team”. In this case, careful training and well-defined policy are required to thwart the seemingly friendly ice cream shop worker.
A good DNS security platform may help filter the URL if it is hosted on a known malicious site. It’s good to remember the majority of the hackers only put in as much effort as they need to, so there’s a high likelihood the URL is hosted from a site used specifically for nefarious purposes and it may not make it through DNS filtering. Layers are the key and some of them are easily and cost-effectively implemented, like DNS security.
CCI Systems experts provide the right solutions for your business’s needs and help you navigate the complexity and prioritize your security efforts.