untangling_the_web

DID: 4046925
UNCLASSIFIEDflFOR OFFl61AL l:J5E ONLY
no Col. Robert Melville at West Point. Aaron Ferguson, a computer-security expert
with the National Security Agency who teaches at West Point crafted the email. The
gullible cadets received a 'gotcha' email, alerting them they could easily have
downloaded spyware, 'Trojans' or other malicious programs and suggesting they be
more careful in the future. Mr. Ferguson, who runs similar exercises each semester,
said many cadets have been victimized by real online frauds.,,192
The problem with this approach is that it can undermine company trust. Who would
ever trust another company email after being caught in a fake spear phishing attack?
The fact remains, users must be extraordinarily vigilant and never provide personal
information that is solicited by anyone without taking steps to verify the authenticity
of that request. Sometimes a phone call is the best way to ensure that an email
request from the HR person for your personal data really came from that department
and not from a spear phisher.
How do you protect yourself from more and more sophisticated phishing scams?
~ never, ever under any circumstances click on a link in an unsolicited email,
especially one that asks you to click on the link to confirm or update personal
or financial information.
~ instead, type the address directly into the browser yourself and then check to
see if that company has any security alerts about phishing scams.
~ always make sure that the SSL is enabled before entering any personal or
financial data; the browser will show a locked padlock: ~ or ~
~ learn how to view and interpret the message source code of an email
message; when in doubt about the true source, assume the worst.
~ stay on top of the news about scams; frequent websites such as the one run
by the Anti-Phishing Working Group.
~ when in doubt, contact the source by telephone to make sure the request is
legitimate.
For anyone concerned about phishing attacks (and that should be all of us), there
are several free online tools to help you tell if a uri in an email or on a webpage is
legitimate (that is, is it what it says it is, or is it something entirely different?). These
"uri decrypters" are designed to reveal the real addresses of obfuscated uris.
Nothing could be simpler to use: just copy the obfuscated uri from an email or from a
192 David Bank, "'Spear Phishing' Tests Educate People About Online Scams," The Wall Street
Journal Online, 17 August 2005, (14 November 2006).
UNCLASSIFIEDf..'FQR QFFISIAb b1S~ QNbY 553