Preventing phishing attacks is not just a technical issue

A client of mine who’s a security administrator for a business in the financial industry contacted me recently about some odd behavior he was seeing on his network. Apparently numerous spidering/mirroring requests were being sent to his company’s marketing website from a foreign country – many of which were triggering “illegal characters in host header” IPS alerts.  He suspected that someone was mirroring the site to gather information for a future phishing attack wanted my thoughts on it. Without knowing any more details or having access to trending information, etc. I told him that it’s not necessarily malicious in intent however I thought he was onto something with the phishing angle.

Even though the suspected malicious activity had likely been completed for some time, blocking the originating IPs at the firewall would be a good first step. However, if the attacker knows what he’s doing, he’s probably making these requests through someone else’s network, through a proxy, or a via a legitimate service such as Anonymizer. So it didn’t make sense to spend too much time on that. Going beyond monitoring the IPS for future anomalies, a further-reaching measure would be to notify other key folks inside the organization such as customer service, operations, marketing, etc. so they can also be on the lookout for (continue reading...)