Download to read offline
Uploaded byPaubox, Inc.
Effective Anti-Phishing Strategies and Exercises - FISSEA 2017 Conference
The document outlines effective anti-phishing strategies presented at the 30th annual FISSEA conference by Hoala Greevy, focusing on the evolving nature of phishing threats and the importance of user awareness. Key points include the increased targeting of familiar contacts, the surge in ransomware attacks, and notable cases of financial fraud related to phishing techniques. The presentation emphasizes best practices such as the use of Google Safe Browsing, improved user training, and potential future solutions like two-factor authentication and machine learning.
More Related Content
Similar to Effective Anti-Phishing Strategies and Exercises - FISSEA 2017 Conference
Effective Anti-Phishing Strategies and Exercises - FISSEA 2017 Conference
- 1. EFFECTIVE ANTI-PHISHING STRATEGIES &EXERCISES 30th Annual FISSEA Conference | Gaithersburg, MD 19 June 2017 @pauboxhq #FISSEA30
- 2. Hoala Greevy Founder CEO,Paubox, Inc. - HIPAA Compliant Email Made Easy. 18 years’ experience in email security & encryption. Phishing & Fishing expert. =) #FISSEA30
- 3. I. What isPhishing Today? II. Threat Landscape III. Best Practices IV. Looking Ahead Agenda #FISSEA30
- 4. I. What isPhishing Today? #FISSEA30 Overconfidence Dilemma Display Name Spoofs Ransomware stealing thunder
- 5. I. What isPhishing Today? #FISSEA30 It’s always been about the $$$.
- 6. I. What isPhishing Today? #FISSEA30 Now it’s about Politics too.
- 7. Overconfidence Dilemma #FISSEA30 2017 phishingstudy, University of Texas at San Antonio Fatal Flaw: Most people believe they are smarter than the criminals perpetrating them. Source: Science Daily
- 8. Display Name Spoofs #FISSEA30 91%of phishing attacks Highly targeted Impersonates someone familiar to the recipient (usually C-Level)
- 9.
- 10.
- 11. Google Docs Phish #FISSEA30 Shutdown quickly. Yet millions affected. Named the app Google Docs Source: Wired
- 12. Ransomware #FISSEA30 2015: 1K daily attacks 2016:4K daily attacks 2017: ?
- 13. WannaCry at aGlance #FISSEA30 Stolen NSA tools North Korea GDP 150 countries At least 230K infected
- 14. Big Tech CompaniesGet Hit Too #FISSEA30
- 15. Facebook & GooglePhished #FISSEA30 Each paid nearly $100M in fake invoices Impersonated Quanta Computer Most funds recovered Source: The Guardian
- 16.
- 17. Office 365 AccountsHacked #FISSEA30 Wire transfer request sent from actual HR employee mailboxes 18,000 accounts affected (why so many?) Source: SC Magazine
- 18.
- 19.
- 20. The Perfect Weapon* #FISSEA30 Cheap Hardto see coming Hard to trace * NY Times
- 21.
- 22. Domain Name ShellGame #FISSEA30 http://shop.radioactivegamingeu.com Resolves to: 104.31.65.24 104.31.64.24
- 23. Who owns theseIPs? #FISSEA30 104.31.65.24 104.31.64.24
- 24.
- 25. III. Best Practices #FISSEA30 GoogleSafe Browsing Macro Policy Level Up User Training (hold contests) Nuclear Option: Macs only?
- 26. Google Safe Browsing #FISSEA30 It’sFree & Constantly Updated Lots of data sources (over 1B users) Used in Chrome, Firefox & Safari Can be used in Email too Source: Google Safe Browsing
- 27. Macro Policy #FISSEA30 Re: allowingmacros via attachments Does the business downside now outweigh the upside? Blog post: We’re Clamping Down on Deadly Macros and Ransomware
- 28. Arthur Ream #FISSEA30 CISO, Cambridge Health Alliance SteakDinner phishing bounty Source: HIMSS Privacy and Security Forum in Boston
- 29. Nuclear Option: Macsonly? #FISSEA30 Something to think about.
- 30. IV. Looking Ahead #FISSEA30 2FAby default Clamp down on Domain Registrars Google Safe Browsing API
- 31. IV. Looking Ahead #FISSEA30 MachineLearning FTW Death of the Appliance (Cloud will win) Port-based Geographic Segmentation
- 32.