Spear-phishing: how to spot and mitigate the menace

Spear-phishing is increasingly being used to penetrate systems as the preliminary stage of an Advanced Persistent Threat (APT) attack, to create a point of entry into the organisation. Employees are targeted with emails containing information personal to them. The unsuspecting employee opens an attachment within the email, or downloads a linked file, which executes and silently installs an APT on a network node within the enterprise. With recent findings that 91% of APT attacks begin with spear-phishing emails and that, increasingly, cyber-criminals are targeting mobile devices using personal data gleaned from social networks, organisations need to work hard to make their employees aware of the threat, reports Tracey Caldwell.