News International Frets Over Spear Phishing Bombardment

News International is a regular target of spear phishing attacks like those that have compromised a number of its rivals and it is something that keeps the company’s head of security awake at night.

Attackers are now producing highly convincing emails, which dupe users into downloading malicious attachments, opening their organisation to data theft and financial damage. And even the most reputable of companies are falling for attackers’ tricks.

The New York Times and the Wall Street Journal admitted their infrastructure had been compromised following spear phishing attacks, allegedly crafted by groups backed by the Chinese government.

Gone spear phishing

But no major UK media outlet has admitted to any similar breaches. News International, a subsidiary of Rupert Murdoch’s News Corp, is one of the world’s better known publishers, and is responsible for a host of famous British papers, including The Times, The Sun and, before it collapsed as a result of the hacking scandal, The News of the World.

It is the target of plenty of hacking attempts itself, according to Amar Singh, News International chief information security officer and chair of the London Chapter ISACA Security Group. He told TechWeekEurope his company sees “a lot of spear phishing”.

He wouldn’t be drawn into saying whether any workers had clicked through, leading to a breach, but admitted it was a “human issue” News International has been working hard to protect itself from in recent months -even before the attacks on its US rivals were widely reported.

“Let’s be honest, you or I will fall for it at sometime in our life,” he added. “There’s no way we are going to be able to block every single click either

“If you and I constantly open emails promising us an insight into what our CEOs are earning and those PDFs are laced with malware, how can [I manage that]?

“How can you dampen human curiosity?”

News International consistently carries out awareness programmes to ensure users aren’t clicking on anything obviously malicious, whilst Singh says he has inculcated a culture where workers pass on dodgy-looking emails so he can review it.

“I’m not someone who likes to sit in an ivory tower. I walk the floor. No email or report is stupid, anything is fine,” he added.

“We are working with employees, helping them. Where necessary we can clean their machines where we know they’ve been infected with malware or whatever.

“It is a constant, ongoing endeavour.”

Talking about the China threat, Singh said every nation was now involved in cyberwar to some extent. Viewing China as chief perpetrator of attacks is perhaps misguided, Singh added, even if many have pointed the finger at the superpower for many high-profile hacks, including recent hits on EADS, maker of the Eurofighter jet, and a group of computer game developers.

Having spoken to a number of CEOs, there was a consensus that  almost every country on the planet, in some form or the other, was using their military arm to engage in “some kind of regular cyber warfare”.

“It’s the US, it’s all of us who are doing it. There is hardly a country left that is not engaging in some kind of retaliatory attack or exploratory attack.”

What do you know about Internet security? Find out with our quiz!