239: Cyber Security – Defend against security threats

Various physical and security threads in companies:

Physical security threats:

1- Leaving keycards (entry system) unattended

2- Tailgating into area

Cybersecurity Threats:

1- Phishing (fishing for passwords)

Scammer uses emails and links inside the websites or chat messages to obtain information with harmful intent.

Some characteristics of phishing messages:

• Suspicious or misspelled sender (name and address)
• Unexpected and surprising message
• Urgent manner or threatening literature
• Typing mistakes
• Unusual attachment file (malicious software)
• Misleading links and very close to real ones (inside emails or messages)

2- Vishing

Scammer uses voice calls or voice mails to obtain information.

3- Smishing

Scammer uses text messages to obtain information.

4- Clone Phishing

Scammer hijacks an email account from an organization to have access to the sent emails. Then selects the target and clones one of submitted emails and provides a follow up email to implement its hack. For example, via attached file or links including the malware for stealing the information.

5- Spear Phishing

Scammer targets specific individuals or organizations.

6- Deep Fake Audio Scam:

A.I. (Artificial Intelligence) voices can be used to scam people. Scammer feeds recorded voice or video of the targeted person into an AI program to learn the voice. Then after typing the sentences, AI program starts reading the text with imitating the voice.

7- Pig Butchering Scam:

Scammer tricks victims into sending money to a fraudulent investment website or application.

Common employee mistakes:

• Skipping device operating system and application update for long period of time.
• Not using MFA (Multi Factor Authentication)
• Accepting MFA push notification which is generated by scammer.
• Not changing the password in long periods of time
• Not changing the password while receiving unexpected login alerts.
• Storing passwords in the browser synchronized with non-secure master account.
• Grant remote access to the computer to not authorized person
• Not verifying the credentials (email addresses and phone numbers)

Cybersecurity attack goals:

• Install malicious software (on computers, phones, industrial machines etc.)
• Obtain passwords or TAN numbers (bank accounts, credit cards and so on)
• Deceiving people in line with the scammer’s goals (making money, espionage, damage the reputation etc.)