Cyber-security and phishing - Revision history

Editor at 11:18, 3 February 2022

2022-02-03T11:18:01Z

← Older revision		Revision as of 11:18, 3 February 2022
Line 11:		Line 11:
	= Constructing a facade =		= Constructing a facade =

−	Cyber criminals are well ~~practiced~~ in the execution of sophisticated phishing attacks. Creating fake email addresses, criminals are able to impersonate familiar contacts in a credible-looking way, so that they are able to dupe their victim and bypass any security measures that are in place.	+	Cyber criminals are well practised in the execution of sophisticated phishing attacks. Creating fake email addresses, criminals are able to impersonate familiar contacts in a credible-looking way, so that they are able to dupe their victim and bypass any security measures that are in place.

	Oblivious to an attack, the recipient believes they recognise the email address and opens the email, which contains innocent-looking links. They are prompted to click links which direct them to a convincing, yet fake, website where sensitive information can be extracted.		Oblivious to an attack, the recipient believes they recognise the email address and opens the email, which contains innocent-looking links. They are prompted to click links which direct them to a convincing, yet fake, website where sensitive information can be extracted.

Editor at 11:17, 3 February 2022

2022-02-03T11:17:10Z

← Older revision		Revision as of 11:17, 3 February 2022
Line 1:		Line 1:
−	An increasing number of high-profile organisations have fallen victim to sophisticated cyber-attacks as Matt Rhodes from Quiss Technology explains.	+	An increasing number of high-profile organisations have fallen victim to sophisticated cyber attacks as Matt Rhodes from Quiss Technology explains.

	= Introduction =		= Introduction =
Line 11:		Line 11:
	= Constructing a facade =		= Constructing a facade =

−	Cyber-criminals are well practiced in the execution of sophisticated phishing attacks. Creating fake email addresses, criminals are able to impersonate familiar contacts in a credible-looking way, so that they are able to dupe their victim and bypass any security measures that are in place.	+	Cyber criminals are well practiced in the execution of sophisticated phishing attacks. Creating fake email addresses, criminals are able to impersonate familiar contacts in a credible-looking way, so that they are able to dupe their victim and bypass any security measures that are in place.

	Oblivious to an attack, the recipient believes they recognise the email address and opens the email, which contains innocent-looking links. They are prompted to click links which direct them to a convincing, yet fake, website where sensitive information can be extracted.		Oblivious to an attack, the recipient believes they recognise the email address and opens the email, which contains innocent-looking links. They are prompted to click links which direct them to a convincing, yet fake, website where sensitive information can be extracted.
Line 79:		Line 79:
	--[[User:CIAT\|CIAT]]		--[[User:CIAT\|CIAT]]

−	= Related articles on Designing Buildings ~~Wiki~~ =	+	= Related articles on Designing Buildings =

	* [[Chartered_Institute_of_Architectural_Technologists_CIAT\|Articles by CIAT on Designing Buildings Wiki]].		* [[Chartered_Institute_of_Architectural_Technologists_CIAT\|Articles by CIAT on Designing Buildings Wiki]].
Line 93:		Line 93:
	* Protecting against online crime.		* Protecting against online crime.
	* Security and the built environment.		* Security and the built environment.
		+	* UK organisations encouraged to review cyber security in response to situation in and around Ukraine.

	[[Category:DCN_Commentary]] [[Category:DCN_Guidance]] [[Category:Theory]] [[Category:Health_and_safety_/_CDM]]		[[Category:DCN_Commentary]] [[Category:DCN_Guidance]] [[Category:Theory]] [[Category:Health_and_safety_/_CDM]]

Editor at 18:12, 7 September 2021

2021-09-07T18:12:34Z

← Older revision		Revision as of 18:12, 7 September 2021
Line 83:		Line 83:
	* [[Chartered_Institute_of_Architectural_Technologists_CIAT\|Articles by CIAT on Designing Buildings Wiki]].		* [[Chartered_Institute_of_Architectural_Technologists_CIAT\|Articles by CIAT on Designing Buildings Wiki]].
	* Cyber hygiene.		* Cyber hygiene.
		+	* Cyber resilience.
	* Cyber security and engineering.		* Cyber security and engineering.
	* Cyber threats to building automation and control systems.		* Cyber threats to building automation and control systems.

Editor at 13:15, 7 April 2021

2021-04-07T13:15:17Z

← Older revision		Revision as of 13:15, 7 April 2021
Line 89:		Line 89:
	* Infrastructure and cyber attacks.		* Infrastructure and cyber attacks.
	* Information and communications technology in construction.		* Information and communications technology in construction.
		+	* Mitigating online risk.
	* Protecting against online crime.		* Protecting against online crime.
	* Security and the built environment.		* Security and the built environment.

	[[Category:DCN_Commentary]] [[Category:DCN_Guidance]] [[Category:Theory]] [[Category:Health_and_safety_/_CDM]]		[[Category:DCN_Commentary]] [[Category:DCN_Guidance]] [[Category:Theory]] [[Category:Health_and_safety_/_CDM]]

Editor at 12:59, 26 February 2021

2021-02-26T12:59:00Z

← Older revision		Revision as of 12:59, 26 February 2021
Line 89:		Line 89:
	* Infrastructure and cyber attacks.		* Infrastructure and cyber attacks.
	* Information and communications technology in construction.		* Information and communications technology in construction.
		+	* Protecting against online crime.
	* Security and the built environment.		* Security and the built environment.

	[[Category:DCN_Commentary]] [[Category:DCN_Guidance]] [[Category:Theory]] [[Category:Health_and_safety_/_CDM]]		[[Category:DCN_Commentary]] [[Category:DCN_Guidance]] [[Category:Theory]] [[Category:Health_and_safety_/_CDM]]

Designing Buildings at 08:10, 29 January 2021

2021-01-29T08:10:08Z

← Older revision		Revision as of 08:10, 29 January 2021
Line 91:		Line 91:
	* Security and the built environment.		* Security and the built environment.

−	[[Category:Theory]] [[Category:Health_and_safety_/_CDM]]	+	[[Category:DCN_Commentary]] [[Category:DCN_Guidance]] [[Category:Theory]] [[Category:Health_and_safety_/_CDM]]

Designing Buildings at 13:11, 26 July 2019

2019-07-26T13:11:15Z

← Older revision		Revision as of 13:11, 26 July 2019
Line 73:		Line 73:

	-----		-----
−	This article was originally published [https://ciat.org.uk/at-journal.html here] in AT Journal edition 124. It was written by Matt Rhodes, Quiss Technology.	+	This article was originally published [https://ciat.org.uk/practice-technical/at-journal.html here] in AT Journal edition 124. It was written by Matt Rhodes, Quiss Technology.

	Matt’s primary role is to expand the hosted solutions division of Quiss Technology and to liaise with software vendors to help them develop their Software as a Service (SaaS) offering. He is a regular commentator on industry topics, covering subjects as diverse as cyber security, hybrid cloud solutions, new technology and the Code of Connection (CoCo).		Matt’s primary role is to expand the hosted solutions division of Quiss Technology and to liaise with software vendors to help them develop their Software as a Service (SaaS) offering. He is a regular commentator on industry topics, covering subjects as diverse as cyber security, hybrid cloud solutions, new technology and the Code of Connection (CoCo).
Line 79:		Line 79:
	--[[User:CIAT\|CIAT]]		--[[User:CIAT\|CIAT]]

−	~~= Find out more =~~	+	= Related articles on Designing Buildings Wiki =
−		+
−	=== Related articles on Designing Buildings Wiki ===	+

	* [[Chartered_Institute_of_Architectural_Technologists_CIAT\|Articles by CIAT on Designing Buildings Wiki]].		* [[Chartered_Institute_of_Architectural_Technologists_CIAT\|Articles by CIAT on Designing Buildings Wiki]].

Editor at 16:24, 25 May 2018

2018-05-25T16:24:57Z

← Older revision		Revision as of 16:24, 25 May 2018
Line 83:		Line 83:
	=== Related articles on Designing Buildings Wiki ===		=== Related articles on Designing Buildings Wiki ===

−	* [[~~User:CIAT~~\|Articles by CIAT on Designing Buildings Wiki.]]	+	* [[Chartered_Institute_of_Architectural_Technologists_CIAT\|Articles by CIAT on Designing Buildings Wiki]].
	* Cyber hygiene.		* Cyber hygiene.
	* Cyber security and engineering.		* Cyber security and engineering.

Editor: Created page with "An increasing number of high-profile organisations have fallen victim to sophisticated cyber-attacks as Matt Rhodes from Quiss Technology explains. = Introduction = An increasi..."

2018-05-25T16:14:00Z

Created page with "An increasing number of high-profile organisations have fallen victim to sophisticated cyber-attacks as Matt Rhodes from Quiss Technology explains. = Introduction = An increasi..."

New page

An increasing number of high-profile organisations have fallen victim to sophisticated cyber-attacks as Matt Rhodes from Quiss Technology explains.

= Introduction =

An increasing number of high-profile organisations have fallen victim to sophisticated cyber-attacks, such as WannaCry back in May 2017 and the more recent ‘Petya’ malware which formed the second major global ransomware attack in just two months.

It is believed that both attacks exploited vulnerabilities within operating systems, having seeded themselves through hijacked software and via phishing emails.

Despite the clear risks, it is reported that around one in ten individuals will still fall victim to a phishing attack, causing disruption to further organisations as a result.

= Constructing a facade =

Cyber-criminals are well practiced in the execution of sophisticated phishing attacks. Creating fake email addresses, criminals are able to impersonate familiar contacts in a credible-looking way, so that they are able to dupe their victim and bypass any security measures that are in place.

Oblivious to an attack, the recipient believes they recognise the email address and opens the email, which contains innocent-looking links. They are prompted to click links which direct them to a convincing, yet fake, website where sensitive information can be extracted.

The email may include toxic attachments containing malware or ransomware. If opened, the device becomes infected and grants criminals access to an organisation’s data.

Criminals continue to find new ways to exploit the weakest point in any system — the people that use it.

= Phishing bait =

Even when an email seems to have been sent by a known contact, determine:

=== The sender ===

Are you sure you recognise the sender? Is their email address legitimate or just similar to one you’ve seen before?

=== Subject ===

Does the subject line correspond to the body of the email? Does it look unusual? Is it poorly written? Any subject lines that seem out of the ordinary could be an indication of fraudulent or spam email so look out for spelling mistakes or an excessive use of punctuation.

=== Content ===

Be cautious if an email asks you to enter personal information, requests a reply or encourages you to visit a website.

=== Links ===

Links in emails can easily be disguised to look genuine but may take you to a malicious website, so think twice before you click.

=== Attachments ===

If there are any documents attached to the email, were you expecting it? Is the attachment mentioned in the email? Do you recognise the format? Only open attachments when necessary and do so with caution as they can easily transmit viruses.

Trends in attack methods change frequently so it would be foolish to assume you know what to expect. Anyone can be outwitted by a criminal so don’t get complacent; the outcome could be disastrous.

= The odds are against you =

Phishing is favoured by criminals as it has a high success rate whilst being low in risk, and:

* 10% of people targeted fall for a phishing attack.
* 23% will open the message.
* 11% click on attachments.
* 250% increase in the total number of phishing sites from October 2015 to March 2016.
* 91% of hacking attacks begin with a phishing or spear-phishing email.
* 55% increase of spear-phishing campaigns targeting employees.

= Phishing for flaws =

Replicating real attack methods, specialist service providers can identify weaknesses in company security systems and train its employees on how to protect themselves from falling victim to phishing emails.

Responses and actions taken are recorded to reveal who opened the emails, clicked links or downloaded attachments, etc.

An email is sent to anyone who interacts incorrectly with the ‘phishing’ email, making them aware of their error and reminding them to be more vigilant in the future. Weaknesses are revealed in a report, enabling businesses to concentrate training where it’s needed most.

Initial failure rates of around 33% will fall to approximately 5%. Unfortunately, a 0% rate is unlikely to ever be achieved as we are dealing with humans.

= Conclusion =

Introducing more technology is unlikely to help reduce the risks posed by a phishing attack. The only reliable solution for any organisation is to regularly test defences and to work on changing its security culture.

Targeting employees with ‘fake’ phishing attacks is an effective way to reveal weak links and help resolve them, but businesses should act fast — it’s only a matter of time before the real criminals show up.

-----
This article was originally published [https://ciat.org.uk/at-journal.html here] in AT Journal edition 124. It was written by Matt Rhodes, Quiss Technology.

Matt’s primary role is to expand the hosted solutions division of Quiss Technology and to liaise with software vendors to help them develop their Software as a Service (SaaS) offering. He is a regular commentator on industry topics, covering subjects as diverse as cyber security, hybrid cloud solutions, new technology and the Code of Connection (CoCo).

--[[User:CIAT|CIAT]]

= Find out more =

=== Related articles on Designing Buildings Wiki ===

* [[User:CIAT|Articles by CIAT on Designing Buildings Wiki.]]
* Cyber hygiene.
* Cyber security and engineering.
* Cyber threats to building automation and control systems.
* Digital communications and infrastructure dependencies.
* Engineering resilience to human threats.
* Infrastructure and cyber attacks.
* Information and communications technology in construction.
* Security and the built environment.

[[Category:Theory]] [[Category:Health_and_safety_/_CDM]]