WHAT IS WHALING ATTACK?

Much like the freshwater or saltwater fisherman, cybercriminals target prey of all types and sizes in their phishing attempts. If each of us can be a victim of a phishing attempt, some cybercriminals target people who are more likely to make big money. Cybercriminals call these targets “whales,” meaning important people, such as presidents or company executives who are prime targets because of their position (agree with you: technically, we don't hook whales, but let's pretend…)

Whaling-type attacks affect a large number of Canadian companies each year. Here's what you need to know to protect yourself and the people around you.

Phishing by email, text message or whaling

For various reasons, the world of cybersecurity is riddled with words that are metaphors for the world of fish and it's not always easy to navigate. So here's what it is:

Phishing is a type of cyber-attack by e-mail, text message or any other direct messaging service which attempts to imitate a legitimate source and which aims to induce the recipient to disclose personal information. When successful, these attacks can cause you to lose control over not only your account, but also your money and your identity.

Spear phishing is a type of phishing that uses information that appears to come from someone you know, such as a co-worker.

Whaling is a type of phishing that targets important people such as senior business executives or senior government officials. Since these people are likely to have confidential information, the stakes are much higher than in the case of a simple phishing attack.

Defend against whaling-type attacks

We protect ourselves from a whaling-type attack in the same way as any other type of attack by using antivirus software and following precautions. But because the stakes are so much higher, cybercriminals put a lot of effort into crafting messages that will successfully deceive their target. Therefore, it will be more difficult to detect that these messages are false.

So, before responding to a message, take the time to check for phishing clues:

Does the email address match the address of the person or entity the sender claims to represent? Does the address or domain name contain additional letters or numbers that should not be there?

Is the formatting of the message correct? Are there any spelling or grammatical errors that a legitimate sender wouldn't make? This kind of mistake can say a lot about the legitimacy of a message.

Does the message contain threatening language or ask you to respond immediately? Such urgent requests can be an indication of a phishing attempt.

It is relatively easy to gather information on the internet about the lives of people who have achieved real notoriety. Don't be fooled by some messages where the sender wishes you happy birthday, asks you how your vacation was or how your wife is doing. These messages do not always mean that the sender is trustworthy.

If you are not absolutely sure of the legitimacy of a message, try to reach the sender by means other than email, for example, by calling. It might seem tedious, but it could save you time and money.

Trust your team

When it comes to cybersecurity, a business is never better protected than its most vulnerable employee. You must therefore ensure that all employees, at all hierarchical levels of the company, are able to recognize a phishing attack. This is an essential condition to ensure the confidentiality of what must be… confidential.

As for the staff who work under the direction of senior management, they must be trained to recognize phishing attempts and whaling-type attacks. These people are the first line of defense against cyber-attacks.

Conclusion

Phishing attacks don't just consist of messages claiming that a foreign prince has made you his heir, or that you have won first prize in a contest or lottery. Whaling-type attacks are much more subtle and difficult to identify. This makes them all the more dangerous and this is the reason why you and your employees must remain vigilant.

Phishing attacks can deceive anyone, even the most tech-savvy. So make sure you know how cybercriminals work and how to recognize the signs of a phishing attempt so that you can protect yourself and your reputation and your organization.