Network Security

            Companies and individuals are finding they need to be more and more diligent in scrutinizing the emails they receive as many of these emails are trying to obtain private and personal information. Phishing is a form of deception in which an attacker attempts to fraudulently acquire sensitive information from a victim by impersonating a trustworthy entity. Phishing attacks typically employ generic "lures (Jagatic, Johnson, Jakobsson, & Menczer,2005.)" Phishing is a form of Social Engineering. Social engineering has emerged as a serious threat in virtual communities and is an effective means to attack information systems. The services used by today's knowledge workers prepare the ground for sophisticated social engineering attacks (Krombholz, Hobel, Huber, & Weippl, 2015, p. 121). Computer systems are vulnerable to social engineering, and +phishing due to users fooled into clicking on links that they believe are from valid companies. PING-based Distributed Denial of Service (DDoS) attacks or a ping flood is an attack executed using ping commands. A ping flood has brought down several high profile web sites such as eBay, ETrade, and Yahoo and has also been used in an attempt to bring down the entire Internet by attacking its DNS root servers (Kumar, S. (2006)). My company launches several phishing campaigns each year to try and fool employees into clicking on links in phishing emails. If an employee mistakenly clicks on a link, they are required to complete employee training on how to recognize phishing emails.

            The dangers of social engineering, along with phishing attacks, is that your personal and sensitive information, along with passwords, can be compromised. The loss of this information can lead to identity theft, financial loss, the ability for criminals to use your account to send spam emails.  For companies, Phishing can lead to criminals having access to sensitive company emails and documents. Once a company's network has breached, this can lead to substantial revenue loss, loss of intellectual property, and damage to brand reputation along with other hidden costs such as legal fees.

            In terms of technical countermeasures, several efforts would reduce the success of many phishing attacks. If digitally signed email became commonplace, this would reduce the likelihood of users falling victim to attacks of this type. The second line of defense might be a browser toolbar, which alerts users of likely Web spoofing attempts, this might allow many subjects to detect a phishing attempt. Providing users with a secure path for entering passwords could be used to alert users that they are attempting to authenticate to an unknown site. Simple spam filters are not likely to have an impact on attacks unless they also detect if email messages are spoofed. Extensive educational campaigns about Phishing that aim to make typical Internet users less vulnerable by a heightened awareness of the dangers of Phishing, and the importance of reporting attacks to which they fall victim (Jagatic et al., 2007).

References

Kumar, S. (2006). PING attack – How bad is it? Computers & Security, 25(5), 332–337. https://doi.org/10.1016/j.cose.2005.11.004.

Krombholz, K., Hobel, H., Huber, M., & Weippl, E. (2015). Advanced social engineering attacks. Journal of Information Security and Applications, 22, 113–122. https://doi.org/10.1016/j.jisa.2014.09.005

Jagatic, T. N., Johnson, N. A., Jacobsson, M., & Menczer, F. (2007). Digital Library: Communications of the ACM. Retrieved April 25, 2020, from

https://dl.acm.org/doi/fullHtml/10.1145/1290958.1290968