PhishMe Expands Phishing Incident Response Platform Capabilities

Announced at RSA Conference 2017: PhishMe Enhances Solution Unmatched in the Industry

SAN FRANCISCO – February 13, 2017PhishMe®, the leading provider of human-phishing defense solutions, announced today that it has released enhancements to improve efficiency and analytics in its phishing threat management and incident response platform, PhishMe Triage™.

PhishMe Triage Integrates with Palo Alto Networks WildFire Cloud to Combat Phishing

Integration Pairs Efficient and Expedient Phishing Incident Response with Integrated Threat Analysis and Prevention

PhishMe® and Palo Alto Networks® technologies equip security teams with enhanced protection against phishing threats.

Conditioning employees to detect and report suspicious email is a strategy security leaders have adopted to protect the business and empower employees to become a defensive asset. PhishMe Triage™ ingests employee-reported suspicious email – allowing security teams to quickly assess and respond to threats.  PhishMe Triage now integrates with Palo Alto Networks WildFire™ cloud-based threat analysis and prevention capabilities to provide an even more formidable approach to identifying and preventing potentially damaging phishing attacks.

When Phish Swim Through the ‘Net

As attackers continue to innovate, preventing successful execution of email with malicious intent will continue to be a challenge if it makes it to the inbox. Ransomware, business email compromise (BEC), malware infections, and credential-based theft all primarily stem from a single vector of compromise – phishing. A key defensive tactic is to condition employees to identify and report suspicious email to security teams for analysis. Yet, security teams need to be efficient and can’t afford to be bogged down with manual processing and analysis when responding to incidents. High functioning security teams must automate the ability to ingest, verify and enforce new protections for potential phishing attacks, all within their existing infrastructure.

Empowered Employees and Technology – Catchin’ Phish!

PhishMe Research has proven that employees who are conditioned to report suspicious email are assets, not liabilities, to the security posture of the business. Reporting suspicious email allows for additional technical and human analysis. Just a single employee reporting a malicious email is enough for security teams using the right resources to identify and disrupt the attacker before they are able to achieve their mission.

That one employee who has received proper conditioning to recognize and report suspicious email serves as an early warning system – tipping off the security team to an anomaly as soon as it hits the inbox!

PhishMe Triage receives reported suspicious email from employees and organizes and analyzes through its own security analytic engine as well as security partner integrations. These integrations allow security leaders to maximize their security technology investments and defenses. Triage identifies what is nefarious, and does it through automation rather than inundating security analysts with more reports to dissect.

Integrated PhishMe Phishing Analysis with Palo Alto Networks

Security teams who aspire to accelerate their phishing analysis can do so with the Palo Alto Networks WildFire API integration with PhishMe Triage. As email is reported to security teams operating PhishMe Triage, Palo Alto Networks WildFire customers can harness the integration capabilities to detect and prevent phishing cyberthreats.

Here’s a sample of how PhishMe and Palo Alto Networks are spotting threats that demand security teams’ attention.

  • The analysis results produced by WildFire are strengthened when PhishMe Triage collects and prioritizes reported phishing attacks from PhishMe Reporter™ and maps useful indicators in the workflow.
  • Customers with a valid WildFire subscription simply enter their API credentials into Triage to enable analysis of file attachments automatically. PhishMe Triage supports customer environments who utilize WildFire in the cloud or an on-premise WF-500 appliance. When configured, these solutions quickly analyze and provide a detailed examination to help security teams determine which threats require immediate attention to remediate or prevent similar attacks.
  • Security teams simply choose the file-types they wish to have automatically analyzed at ingestion. The analysis results are then contained within PhishMe Triage and clustered to allow analysts to swiftly respond to the most critical.
  • PhishMe Triage scrutinizes suspicious email at ingestion and uses the WildFire API to send the file(s) to determine their cyberthreat verdict. Quickly, the analyst receives integration results back into PhishMe Triage with summary detail and a thorough human-readable report illustrating the threat’s characteristics.
  • With PhishMe Triage rule matching, reputation of the employee reporting, threat intelligence, and combined threat analysis from the WildFire cloud, analysts will be confident in their response and automation workflow action. Security teams can manually or programmatically categorize the threat to follow a workflow involving support for leading SIEM providers.

More about WildFire:

Palo Alto Networks WildFire™ cloud-based threat analysis and prevention service analyzes files and links and designates never-before-seen items for further investigation using static and dynamic analysis over multiple operating systems and application versions. If a sample is categorized as malicious, WildFire will automatically generate and populate a holistic set of new preventions to the Palo Alto Networks Next-Generation Security Platform and integration partners, minimizing the risk of infection from both known and unknown threats without any additional, manual action. WildFire correlates global, community-driven threat intelligence from multiple sources across networks, endpoints and clouds to immediately halt threats from spreading. WildFire’s architecture provides granular controls over what data will be submitted for analysis. Elements like file type and session data, as well as choosing the data path and regional WildFire cloud where the analysis and data storage will take place, are all configurable.

 

To learn more about the Palo Alto Networks Next-Generation Security Platform and WildFire, visit: https://www.paloaltonetworks.com/products/designing-for-prevention/security-platform

To learn more about the PhishMe Triage, visit:  http://phishme.com/product-services/triage.

For more information, download the full solution brief.

PhishMe Announces New Premium Features for Flagship Product PhishMe Simulator

 

Global Phishing Defense Leader Demonstrates Continued Commitment to Innovation via Product Enhancements

SAN FRANCISCO – February 13, 2017PhishMe®, the leading provider of human-phishing defense solutions, announced today at RSA Conference 2017 that it has added advanced enhancements to its behavioral conditioning program PhishMe Simulator™ to meet the ever-changing needs of organizations of all sizes.

Got Any Good Phishing TIPs?

PhishMe Intelligence Integrates with Industry Leading Threat Intelligence Platforms (TIPs)

Swimming in a sea of threat intelligence indicators and services, security teams have been working towards effective ways to centralize, de-duplicate, and correlate massive amounts of threat data. The challenge is once this is done, acting on the what matters most. This requires intelligence, not just data.

This is why PhishMe has completed technical integrations with TIP partners Anomali™ and ThreatConnect®. These integrations offer security teams the ability to ingest and correlate phishing-specific indicators with easy-to-act-on impact ratings and contextual reports to make confident security and business decisions.

PhishMe Intelligence customers gain from our human-verified phishing intelligence. What does this mean? It means that our customers receive phishing indicators from daily criminal phishing campaigns such as compromised IP addresses, domains, URLs, hashes, and botnet and command and control infrastructure. These indicators and credible intelligence reports are meticulously maintained and verified by PhishMe security researchers. Customers receive expert phishing intelligence that connects indicators with threat actors’ infrastructure so that security teams can confidently act quickly and accurately in their investigations.

PhishMe precisely delivers timely indicators and intelligence about ransomware, business email compromise, credential-stealing phish, and other malware. It is the timeliness and accuracy that is so crucial because the longer it takes security teams to determine the impact and severity of the threat, the more time the attacker has to plot their next move and achieve their mission.

When PhishMe designates an indicator with a major impact rating, teams can heed this warning and confidently take action. PhishMe doesn’t just tell security teams what is malicious, we explain why something is malicious. This is the context that allows analysts to act on the data analyzed and enriched by trustworthy PhishMe researchers.

PhishMe also helps answer the never-ending question; “is this a threat to my business”? The Active Threat Reports are contextually-rich reports that illustrate threat actor tactics and the neighboring criminal infrastructure that supports their operation. The reports take “so what” about an indicator, and provide an inside-out view of the threat actor and tactics.

Security analysts spend less time deducing and more time executing.

Security teams invest in TIPs as a way of bringing multiple sources of data into a centralized location that can be correlated and then distributed to other systems as part of the workflow. Open source, paid subscription, and industry-specific intelligence exchanges, all provide a useful purpose in managing threats to the business. The difficulty is managing vast amounts of data and ensuring a low signal-to-noise ratio. As such, TIPs emerged to support the endless need for data analysis and decisive action.

PhishMe Intelligence product management and solution engineers collaborated with TIP providers to complete technical integrations suited for security teams accountable for defending the business.

Conclusion

TIPs emerged to help security analysts who are inundated with so much information and the need to centrally manage it. They’ve become a concentrated repository for security teams to ingest, de-duplicate, analyze, and act on the indicators received. PhishMe’s technical partnerships with Anomali and ThreatConnect, will help ensure that the quality of intelligence available is second to none when it comes to indicators of phishing. Phishing is the primary vector of compromise and oftentimes leads to data loss. Consuming human-vetted phishing intelligence into a TIP ensures security teams can be confident in the action they take to protect their business.

Sage and Locky Ransomware Now Sharing Delivery Infrastructure in Phishing Attacks

BY BRENDAN GRIFFIN AND GARY WARNER

Threat actors have demonstrated that despite the past two years’ explosion in new ransomware varieties, ransomware developers still believe that the market has not reached the point of saturation. Examples of encryption ransomware like Sage have made notable appearances on the phishing threat landscape in the early days of 2017, continuing the ransomware trend from 2016.

PhishMe Reports Explosive Growth: Annual Run Rate Approaches $50 Million

Continued Growth Driven by Innovative Offerings and Strong Execution

 LEESBURG, VA January 31, 2017: PhishMe Inc., the leading provider of human phishing defense solutions, today announced another year of record growth, with Annual Run Rate (ARR) approaching $50 million. PhishMe’s more than 300 employees now serve 1,200 enterprise customers world-wide to defend against cybercriminals, hacktivists and state-sponsored hackers.

PhishMe is a Finalist in 4 Categories for the 13th Annual 2017 Info Security PG’s Global Excellence Awards

We are excited to announce that PhishMe has been selected as a finalist for the 13th Annual 2017 Info Security PG’s Global Excellence Awards in not just 1 but 4 different categories!

  • The first award is for Rohyt Belani, who has been honored as a “CEO of the Year” category winner of the 2017 Info Security Products Guide Global Excellence Awards for the second year in a row.
  • Fellow co-founder and CTO, Aaron Higbee, was honored as a finalist for the “CTO of the Year” category award.
  • PhishMe also was selected as a finalist for the “Best Security Service” and “Best Deployments in U.S.A.” award categories.

These prestigious global awards, put on by one of the industry’s leading information security research and advisory guide, recognize security and IT vendors with advanced, ground-breaking products and solutions that are helping set the bar higher for others in all areas of security and technologies.

“It is truly an honor to be recognized as a CEO of the Year by Info Security Products Guide for a second year in a row,” said Belani. “You are only as good as the people you surround yourself with. The real winners are the talented employees at PhishMe. These awards are proof of the hard work and dedication of every member of the PhishMe team.”

Belani and Higbee have led PhishMe from its infancy to a company with more than 200 employees and 892 percent growth in just 3 years, establishing themselves along the way as thought leaders in the cybersecurity industry. The company has secured several other major industry accolades including recognition in the 2016 SC Magazine Awards, Inc 5000 and the Deloitte Fast 500.

PhishMe’s world-class solution has emerged as a dominant force in the phishing threat management space with almost half of the Fortune 100 companies using its platform for attack identification, human-verified intelligence and incident response. The company’s achievements in 2016 have cemented its position as an innovator at the forefront of phishing defense technologies and laid the groundwork for further innovation in the coming years.

We look forward to seeing you all at RSA Conference in San Francisco, where we have two different booths: S1715 in the South Expo and N4601 in the North Expo.

 

To learn more about the 2017 Info Security PG’s Global Excellence Awards, visit http://www.infosecurityproductsguide.com/world/.

Employee reporting of suspicious emails substantially outweighs susceptibility to attacks

Following a thorough analysis of 40 million phishing simulation emails, PhishMe’s latest research measures global susceptibility and resilience to phishing threats

 LEESBURG, VA December 13th, 2016: PhishMe Inc., the leading provider of human phishing defense solutions, today released its 2016 Enterprise Phishing Susceptibility and Resiliency Report, which illustrates employee susceptibility to phishing emails and resilience improvements when engaged in security reporting. With phishing still the most common cyber-attack vector leading to data breach, the report analyzes the most successful triggers, themes and emotional motivators leading employees to fall for phishing emails, as well as how reporting can drive a decrease in time to attack detection from days to minutes.

The PhishMe research teams analyzed data compiled from over 40 million phishing simulations performed between January 2015 and July 2016. Responses were gathered from a sample of over 1,000 PhishMe customers across the globe, including Fortune 500 and public sector organizations from 23 industry verticals. Published today, PhishMe’s 2016 Enterprise Phishing Susceptibility and Resiliency Report identified the following insights:

  • Business context phishing simulation emails still the most challenging: Office communications and finance-related themes generated the highest susceptibility rates, with 19.9 percent and 18.6 percent respectively, driven by sentiments of curiosity, fear and urgency.
  • Reporting outweighs susceptibility to phishing: Over a relatively short amount of time, reporting rates bypass susceptibility rates when at least 80% of the company has been conditioned to identify and empowered to report suspicious emails.
  • Active reporting can significantly decrease breach detection times: Samples analyzed show reporting of suspicious emails reduced security team response time to approximately 1.2 hours over the currently industry average of 146 days to detect a security breach.

PhishMe’s analysis revealed that business or office-related phishing emails proved to be the most effective simulations, as well as the most difficult for users to recognize and report. Phishing emails with sentiments of curiosity, fear and urgency scored the highest percentage in average response rates, suggesting that employees are at risk of increased susceptibility to phishing campaigns that include an emotional pull, even at a subconscious level.

“Our analysis shows that continued exposure to simulations lowers the chance of an employee falling for a phishing email – the key being consistent exposure,” stated Aaron Higbee, Co-Founder and CTO at PhishMe. “Once employees are conditioned to identify phishing attacks, our data shows that reporting them to the IT Security team starts to outweigh organizational susceptibility.  It only takes one employee to report a targeted attack to give incident response teams a chance to stop a potential data breach. Armed with this new data, we hope that more CISOs focus their attention on the ratio of Report-To-Click instead of dwelling on susceptibility metrics.”

The 2016 Enterprise Phishing Susceptibility and Resiliency Report also analyzes variances in phishing simulation response by themes, emotional triggers, and average response rates per industry. In looking at one particular type of phishing email type, the “file from scanner” scenario generated the highest number of response rates in the transportation sector at 49 percent, followed by healthcare at 31 percent and insurance at 30 percent. On the other hand, the non-profit sector scored the lowest response rate, at a 5 percent.

“Understanding what motivates your employees to open or fall for a phish is a critical step in building their resiliency to attacks and enabling faster incident response” continued Higbee “At its core, a phishing simulation program allows organizations to assess, measure, educate and empower all employees about phishing threats while creating a wider net of human sensors to help reduce the risk of a full-blown data breach.”.

 

To download a full copy of the 2016 Enterprise Phishing Susceptibility and Resiliency Report, click here.

A Warning on Christmas Delivery Scams

The time of year has once again arrived when post offices are busier than the freeway on a Friday evening. We buy gifts, online and in stores, and we send and expect packages to and from the far corners of the country, continent, and even the world.

Yet behind this frenzy of merriment skulk a series of dangers. Although Christmas is still more than a month away, scammers of this kind have already been active in various areas across the US. For a number of years, security experts have grown to expect a hike in the number of internet scams being spotted around the festive period, from fake deal websites to counterfeit greeting ecards. One example is becoming highly-popular among threat actors and is better positioned to trick even the most security-aware individual: failed delivery phishing scams.

UPS estimates that in the U.S., more than 630 million packages were delivered by shoppers during the holiday period last year, and FedEx predicts  317 million shipments between Black Friday and Christmas Eve. With all this holiday mail, not to mention everyone out and about to prepare for their celebrations, it is not surprising to find a “delivery failed” notice in your inbox. If the message concerns something needed by Christmas, the annoyance at having to re-organize a delivery can make us act rashly and even foolishly.

It is widely-known that the keys to successful social engineering are fear and greed.  When presented with compelling stimuli under these categories, criminals can count on a significant number of their potential victims briefly suspending their information security awareness training and clicking the link.  As Christmas approaches, certain malware families such as ASProx may have high-volume spikes, taking advantage of shoppers lowering their guard.  In December 2014, spammers used ASProx to deliver fear in the form of a Failed Delivery email from big, respected brands like CostCo, BestBuy, and Walmart.  Recall that PhishMe’s Gary Warner identified more than 600 hacked websites that were used as intermediaries to prevent detection by causing the spammed links to point to websites that had been “known to be good” until the morning of the attack.

So who should be on the lookout for these scams, and what can be done to protect Christmas shoppers?

Basically everyone, from individual consumers to massive businesses, should be on high alert. Though we should not let scammers turn shoppers into paranoid victims, being able to spot the details that reveal a scam can be the only thing standing between a scammer and your personal or company bank account details. While Christmas scams are thought of as dangerous, if the computer used to access these websites is a company or government computer, these scams can have a wide-ranging and long-term impact. And with nearly , this is a subject to take extremely seriously.

So be vigilant, and have a very merry (and scam-free) holiday season.

 

Did you know that 97% of phishing emails delivered in 2016 contained ransomware? Learn more by downloading our latest Q3 Malware Review.

SC Magazine Awards Recognize PhishMe as Finalist in Best IT Security-Related Training Platform Category for the Second Year in a Row

Fresh off our win in the same category last year, we’re thrilled that PhishMe Simulator has been chosen as a finalist once again in the 2017 SC Magazine Awards for Best IT Security-Related Training Platform. The award highlights companies and organizations that provide end-user awareness training programs for enterprises to ensure that employees are knowledgeable and supportive of IT security and risk management plans.

We’ve worked hard to live up to the honor of winning this prestigious award and many others such as being named a leader in the Gartner Magic Quadrant for Security Awareness Computer Based Training.

This industry recognition reinforces PhishMe’s commitment to delivering the best solutions to combat today’s top cyberthreats such as phishing emails and their malicious intent – whether malware, BEC or credential theft. These types of attacks show no signs of slowing down – and neither will PhishMe.   Just recently, Europol named ransomware the top cybercrime threat and our own PhishMe Q3 Malware Review showed that 97 percent of phishing emails now contain some form of ransomware.

As the reigning winner of this award, we have strived to spread our philosophy that Awareness is Not Enough. By leveraging our unique approach to phishing defense, our customers have been able to train their employees to be security assets instead of vulnerabilities by behaviorally conditioning them to identify and report threats. As such, we look forward to being considered by the judges as a finalist for another year in the training program category.

By empowering employees with the proper conditioning needed to detect and report malicious phishing emails, our users quickly and efficiently assess organizational risk, identify areas for additional improvement as well as provide security teams with effective intelligence that allows them to respond to incidents in a timely manner. In some cases, this type of conditioning has reduced a company’s overall susceptibility by more than 95 percent.

We’re excited to find out if we’ve made the cut again during the awards ceremony Tuesday, February 14 2017 at the Intercontinental San Francisco. Wish us luck!

 

To learn more about the SC Magazine Awards, visit https://www.scmagazine.com/awards/

Learn more about our multi-lingual, complimentary, computer based training – PhishMe CBFree.