Is Your CEO a Cybercrime Target?
You and your systems may be all that stand between your boss and a vicious, targeted cyberattack.
Computerworld - A CFO at a Fortune 1000 company holds his cursor over an e-mail that appears to be from a direct report. In reality, it's from someone he's never met, a criminal who's targeted and stalked the highly compensated executive, searching through company SEC filings and compiling personal details through corporate and social networking sites.
Now the cybercriminal is in position to launch an attack that will allow him to mine the CFO's hard drive for credit card numbers, passwords to corporate databases or other proprietary information.
In one click, the CFO is going to have himself a big problem. If you're his IT manager, you're going to have one too.
If Viagra-touting spammers and credit card phishers are the carpet-bombers of computer crime, so called C-level attackers are the snipers. They mine information from a relatively small number of wealthy or high-status individuals in positions of power.
The treasure sought is corporate and/or personal data, both of which can be extremely lucrative. The hackers can use the information they garner to wreak further havoc elsewhere or, more likely, they will sell it and resell it for profit through online underground servers.
These types of targeted C-level attacks are rare, but they're on the rise, and they're sophisticated enough to make the average IT manager's blood run cold.
Following the Money Trail
C-level attacks "started out about a year ago in very low numbers but have been ramping up since," reports Matt Sargeant, senior antispam technologist for MessageLabs Ltd., a New York-based security services provider.
Last summer 24-year-old Russian Igor Klopov and four others were indicted by a New York grand jury for stealing $1.5 million and attempting to steal another $10.7 million from more than a dozen wealthy victims. Klopov used the Forbes 400 list of the world's wealthiest people to pick his marks. They included Texas businessman Charles Wyly and Anthony Pritzker, president of TransUnion Credit (and member of the prominent Pritzker clan of Hyatt Hotel fame.)
The government charges that Klopov found information on some of his victims' real estate holdings and lines of credit -- much of which was publicly available -- and used it to build dossiers on them. He used Monster.com, CareerBuilder.com and similar employment sites to recruit accomplices.
The gang created and used fake IDs to contact the victims' financial institutions (JPMorgan Chase, Merrill Lynch and Fidelity Investments) to try to gain information on their accounts, get duplicate checkbooks and the like. The institutions flagged the attempts and contacted the authorities.
An IT manager at a Fortune 500 financial institution says his company, too, was recently affected by a C-level attack. In this instance, a bank executive's laptop was hacked while he was working from home. The hacker captured passwords and log-ins and tried to access some of the bank's accounts. The attempt, which was later traced to a Russian IP address, failed, says the source, who spoke on condition of anonymity.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts