Benjamin Hosack
2 min read

Subscribe to our Blog

Well, we know that most people reading this would think something along the line of "those execs must be living in the dark ages to have been duped into giving out their credentials - we all know about these phishing scams, social engineering etc" (most probably you're thinking something less polite).

Well, our experience is different and we completely understand how easy it would have been for those execs to have been duped into giving out their account credentials.  The fact that it happened is not an excuse - however, they are probably like most organisations out there.  Execs know about security issues - superficially - but either think its none of their business (its an IT issue) or assume it will not happen to them.

In our Incident Response and Readiness Service, one of the service components is focused on simulating an attack - we spend time getting to know the organisation from afar, understanding who is who in the business, what their online profiles are, sometimes going as far as finding out where they live and other aspects of their personal lives - be assured attackers have no boundaries when it comes to respecting your personal space! This information forms the basis of a simulated attack on the business to see how far we can get.  In most cases, we easily compromise C-Level execs - in some cases even the Security Officer.  Once we've carried out this attack, we use it to demonstrate the importance of understanding the threats to the business and of educating the business team.  

So, when we hear that hackers targeted executives to trick them into revealing their online credentials - it doesn't surprise us that they were successful.  After all, how many businesses actually go so far as carrying out detailed tests of their defences and their team's knowledge?  Our impression is that not many do it well enough and we'll bet that this is something that Sony wished they had put more thought into.

If all of this is getting you thinking about your business and your capability to defend against and respond to such an attack, you may want to take a look at our Incident Response Planning Guide - its FREE and you can download it here:

Click here to download our  Incident Response Planning Guide

e259b111-d3c6-4d8f-b50d-83af7d21f2c6-620x372Sony Execs Duped by Hackers

A report on the Associated Press website - "N Korea-linked Sony Attack may be costliest ever" outlines some of the financial costs of the attack.  Further down in the article, they state that "Hackers targeted executives to trick them into revealing their online credentials".

Contact Us

Access cybersecurity advisory services

 

Benjamin Hosack
Benjamin Hosack

Benj Hosack is a Director and co-Founder of Foregenix Limited. Foregenix is a specialist information security business delivering services in Forensics, PCI DSS, PCI P2PE, PA-DSS and information security solutions within the Payment Card Industry. Our technologies are designed to simplify security and PCI Compliance. Specialties: Cardholder Data Discovery - defining and reducing PCI DSS Scope / PA-DSS / PCI DSS / P2PE / Account Data Compromise Investigations. We are specialists in the Payment Card Industry and work with all types of companies in the payment chain (Acquiring banks, Processors, hosting providers, web designers, merchants, systems integrators etc).

See All Articles
SUBSCRIBE

Subscribe to our blog

Security never stops. Get the most up-to-date information by subscribing to the Foregenix blog.