Phishing Vulnerabilities In Microsoft's Internet Explorer, Plus A New Server-Access Ploy
Until recently, consumer advocates recommended that you check the browser's URL window and make sure it confirms that you've linked to the site you expected. If the two didn't match, you knew you were being spoofed from a phished link.
However, Internet Explorer allows the spoofed site to appear to be the one you trusted. People relying on consumer-safety tips to avoid becoming victims of spoofed and phished links would find themselves tricked into compliance.
When the vulnerability was discovered in mid-2003, Microsoft responded by saying it was looking into the problem. When I consulted one of their spokesmen in December 2003, the company still hadn't taken any action or made any firm decision about what, if anything it will do to close the vulnerability. The spokesman indicated that perhaps Micrososft would include a patch in its monthly patch updates, but wasn't certain. But since the real answer here isn't turning our customers into cybersleuths to spot the latest fraud, it really doesn't make much of a difference if or when it patches the vulnerability.
Roundabout Server Access
Although phishing incidents involving third-party E-mails are the most common, a new scheme has arisen involving cybercriminals seeking access to your company's servers.
An E-mail is sent to those within the corporation, appearing to be from internal legal, IT, or security administrators. The E-mail announces a security breach, or problem within the network. It advises the employee to log into the company's network, using the link provided in the E-mail. Once the employee types in their login and password, the phishing expedition was successful. They now have access to the company's communications and password protected network. By targeting employees with all levels of access, to all segments of the server, they are able to gain access to most, if not all, of the server data and infrastructure.
So, look within, as well as to outside communications when warning your employees about intrusions and fraud. It's well known that the fastest way to break security on a secure network is to fool someone with access into letting you in. Don't let your employees provide the key to the burglars. Set up a confirmation process and make sure your employees know how you will communicate any security breach. Make sure they have a contact E-mail or telephone number where they can confirm the validity of any communication, and a network posting of any emergency announcements. Forewarned is forearmed.
The Business of Going DigitalDigital business isn't about changing code; it's about changing what legacy sales, distribution, customer service, and product groups do in the new digital age. It's about bringing big data analytics, mobile, social, marketing automation, cloud computing, and the app economy together to launch new products and services. We're seeing new titles in this digital revolution, new responsibilities, new business models, and major shifts in technology spending.
What The Business Really Thinks Of IT: 3 Hard TruthsThey say perception is reality. If so, many in-house IT departments have reason to worry. InformationWeek's IT Perception Survey seeks to quantify how IT thinks it's doing versus how the business views IT's performance in delivering services - and, more important, powering innovation. The news isn't great.