SUCCESSFUL ARMED FORCES EMPLOYMENT PROGRAMME EXTEN... » An innovative programme that helps jobseekers who have an interest in the Armed Forces get into work... NW Systems helps meet safeguarding needs of Outs... » Hoylake-based NW Systems has provided an advanced IP video system to help Wirral Hospitals’ School, ... UK TROOPS TO TRAIN MODERATE SYRIAN OPPOSITION » THE Defence Secretary has announced today that the UK will provide further support to the internatio... Options secure new multi-million pound banking f... » London / New York: Options has announced that they have secured a new multi-million pound banking fa... £200,000 Tees Valley Catalyst Fund loan helps Co... » A Cramlington-based company has won a $6 million contract with Hyundai Engineering & Construction to... 2019: The danger that lies ahead, but what time is... » A SPECIAL ANALYSIS ON THE NIGERIAN POLITY FROM 1914 - TILL THE PRESENT “Justice is the constant... GOODLUCK EBELE JONATHAN & HIS ROCK STEADY BROTHEL:... » THE DUMBING DOWN OF VALUES IN THE AGE OF JONATHAN: STANDARDS IN PUBLIC LIFE BEGINNING AT THE PRESIDE... Becrypt announces publication of CESG approved gui... » London, UK: Becrypt has announced that CESG, the UK’s National Technical Authority on Information As... Semafone partners with AsiaPay to offer secure pay... » Guildford, Surrey, UK: AsiaPay has announced that Semafone®, the international provider of secure pa... Wick Hill named as one of ‘1000 companies to inspi... » Woking, Surrey: After an incredibly successful 2014, and being named Woking’s ‘Most Successful Compa...

CLICK HERE TO

Advertise with Vigilance

Got News?

Got news for Vigilance?

Have you got news/articles for us? We welcome news stories and articles from security experts, intelligence analysts, industry players, security correspondents in the main stream media and our numerous readers across the globe.

READ MORE

Subscribe to Vigilance Weekly

Information Security Header

Just about everyone with an interest in IT security knows that phishing is the practice of impersonating an official website in order to trick a user out of personal information, usually its username and password.

 

But we’ve found ourselves wondering – when do people learn about phishing?

The question was triggered by a recent spam run that turned up in the Barracuda Labs honeypots. While specifically targeting Trinity College in Connecticut, this spam is representative of email account phishing in general.

Like many organisations, Trinity College requires its computer users to change their account passwords periodically – every 120 days in this case. Email reminders are sent out and are expected. Indeed, ignoring one of these reminders can result in deactivation of your account.

We don’t have one of these reminder emails but we certainly hope that they don’t contain a clickable hyperlink. Barracuda Labs always recommends that you do not follow links in emails, regardless of how convincing they may appear. Instead, and as the college recommends, you should browse to the website of the institution and update your password there.

Ignoring our advice and clicking on the emailed link sends the browser to the phishing site, cleverly crafted to look like the college’s real login page.

A cursory examination of both the phishing site and email shows that the login page is not actually hosted on a domain owned by the college. Instead it is served by a possibly compromised website in Russia. Careful email users delete this sort of spam.

But what about 18-year old freshers who might never have been told what phishing is and how it works? For many young people, university is their first time living away from home, and although many have good, even exceptional computer skills, not all do. It’s a good bet that many college freshers know more about safe sex than safe email.

At Trinity College, a username and password gives students and faculty access to all of the computing resources that the college offers. Once such credentials are harvested by a phisher the entire network is at risk. The same is true for almost any enterprise network. Safe email has never been more important.

Account security, especially for inexperienced users, has to be something more than “choose a hard to guess password and keep it safe” buried in some employee handbook. Phishing techniques and how to spot them need to be communicated right away, ideally on the same page that includes a username and initial password. You may not run a college full of recent highschool graduates, but new users in any organisation need that sort of security training supplied prominently and pro-actively.

When do people learn about phishing? That’s hard to say, but when people should learn about phishing is every time they receive an email account.