Security Features
On October 8, 2013, the United States government issued a new $100 note.
Counterfeiting is a classic social engineering problem. While trained experts can distinguish fake currency from real currency, the primary users of currency are not currency experts or machines – the primary users of currency are people who are non-experts. Counterfeiters exploit the fact that in order to be successful, they need to deceive non-expert users of currency who are busy doing other things. A counterfeit bill does not have to be perfect, it has to be good enough. This presents a challenge to governments because good currency has two competing objectives — it has to be easy to validate and hard to make. In introducing the new currency, Federal Reserve Board Governor Jerome Powell said, “The new design incorporates security features that make it easier to authenticate, but harder to replicate.”
Spearphishing is a cyber version of counterfeiting. Instead of fake currency, the miscreant is using fake email to deceive people who are non-expert users. Just like with counterfeit currency, the bad guy does not have to create a perfect fake email, only one that is good enough to deceive the non-expert users. Just like real currency, real email has two competing objectives – it has to be easy to validate and hard to make. Regrettably, email technology makes it very easy to create good enough fake emails. For example, this is the fake email that deceived an AP reporter and compromised his system:
Despite the defects revealed upon close examination, this email from the Syrian Electronic Army was good enough to deceive the reporter. That deception resulted in the compromise of the AP twitter credentials. The stolen AP twitter credentials were used to issue an AP tweet that the President was injured in a bombing. That tweet caused $140 billion in stock market losses.
SP Guard from Iconix provides security features in email. Just like the new $100 note makes it easy for non-experts to tell real money from fake money, SP Guard makes it easy for non-experts to tell real email from fake email.
Make it easier for your email users to avoid deceptive emails. Use SP Guard to add security features to your email. Contact Us Here.