- So does the spam filter really protects us against
spear phishing attacks.
Well, there are so many ways how spear phishing attacks
can still bypass spam filters.
But I will not talk about them today.
What I'll talk about is something even more dangerous,
which is social media.
Here's the thing, there's so many people, so many of us
who use social media in our work laptops,
I'm not talking about Facebook or Instagram or TikTok,
but I'm talking about LinkedIn as a professional network.
And there's so many people who especially work in HR
or even the Sales team.
They do use LinkedIn to promote the company,
they promote different jobs in there,
different careers and so many different communication
that's being done professionally through LinkedIn.
The problem here is that with all of this social media,
there is no spam filter protection
that's actually happening on this social media.
We don't know who are these accounts,
what they are giving,
what files they are sending to us,
and how dangerous these files could be.
Someone can send to an HR
documents saying it is his resume,
or can send to a Sales or Marketing person,
especially now I see so many companies
they start to apply this personal branding
and they start with someone in their Sales team
or someone from the Marketing team
to be the face of the company.
They build a personal brand marketing the company.
And what happens is they're getting contact
with so many different people
who are interested in doing business with this company.
That sounds great.
But the bad thing is that you can easily receive
prospects, invoices and so many different things
on their LinkedIn account.
They can easily still have so many tricks
to send to them these files
even if they are not in a previous contact before.
It's easier on LinkedIn to add so many different people
to build the credibility or a fake credibility
and to act as you're working in a legitimate company.
There is no checks on if this person actually
who is actually working in that company.
There's no check, he can actually claim
he is working in this company,
and nobody will even detect this company itself.
So, the problem here is that
the bottom line is that social media is something
can bypass all of this email filtering
and all this spear phishing techniques
and they can easily enumerate all the employees
in the company, all of the teams that are working
inside this company
and send them spear phishing social media messages.
The question is, what is the procedures?
What is the work in these programs sorts?
What is the tips and tricks,
and the programs and the trainings that we can do
to actually protect our employees,
or the people who are working in our company
from being vulnerable to this type of attacks?
Not only the social media is a big danger,
the second danger we have is the Supply Chain.
You see, if you're working in a big enterprise,
most probably that you have
all the different autism in place,
different spam filters, different technologies,
and different things to protect against
lots of different attacks.
Well, at least I hope that you have all of them.
But if this is a small company,
you're building a trusted relationship with them.
The problem is that they are weaker
when it comes to a security part.
They are a small company,
their budget for security is way less,
and their ability to afford
really good protection technologies
or hiring the talents,
the real talents in their security team
to detect different attacks is way less.
And here's the thing, it's easier for an attacker,
or a group of attackers to actually attack
the small companies, get inside these companies
and use this trusted relationship
between them and the beginning to the past
to get into the beginning of the process.
They can use their emails,
they can use their updates program
if they are big enterprises using their tools
and they are using some of their products,
they can leverage the live data
and actually inject the monitor inside the source code.
This actually happened before
and actually happened in a bigger scale
when you are able to get into ASUS company,
they get into the Live Update program
and they were able to inject a malware inside
1 million devices in 2019.
That actually happened between 2018 and 2019.
And not only they got into 1 million victims,
but also they got into other three companies
who were producing games,
and sold these games, and they were able
to inject the malware inside the source code of these games,
able to infect way, way more people
through these three games.
So there was a big disaster.
And here's the thing, Supply Chain type of attacks
is way common and the use of Supply Chain with malware
makes it really, really deadly.
So what are the technologies?
What are the programs that were in these programs?
What is the sign in is what is
the audit programs to protect against this type of attacks?
Social media attacks,
Supply Chain attacks,
and any attack that can leverage faster chain,
or trusted communication channel to deliver the malware
and actually get into one of the security networks
of this enterprise.
So there's this video that asks questions
and talk about different threats
that we are most probably facing.
If you have an idea of how we can protect against them,
please put that in the comments.
Please share these videos because we need more warnings on
what type of the next attacks we are facing
and what we should start investing on
to better protect our employees.
So hope you liked this video,
see you in the next video, bye, bye.