TECHNIQUES FOR PREDICTING AND PROTECTING SPEARPHISHING TARGETS

• US 20140283035A1
• Filed: 03/15/2013
• Published: 09/18/2014
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: SAWHNEY, Sanjay, ROUNDY, Kevin Alejandro
• Granted Patent: US 10,069,862 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

Techniques for predicting and protecting spearphishing targets are disclosed. In one particular exemplary embodiment, the techniques may be realized as a system for predicting and protecting spearphishing targets. The system may comprise one or more processors communicatively coupled to a network. The one or more processors may be configured to identify one or more potential spearphishing targets based on information from an organization, receive additional information associated with the one or more potential spearphishing targets and the organization from publicly available sources, determine a threat level of a spearphishing attack on the one or more potential spearphishing targets based on the information from the organization and the additional information, and generate a report of the one or more potential spearphishing targets and the threat level associated with the one or more potential spearphishing targets.

Claims

1. A system for predicting and protecting spearphishing targets comprising:

one or more processors communicatively coupled to a network, wherein the one or more processors are configured to;

identify one or more potential spearphishing targets based on information from an organization;

receive additional information associated with the one or more potential spearphishing targets and the organization from publicly available sources;

determine a threat level of a spearphishing attack on the one or more potential spearphishing targets based on the information from the organization and the additional information; and

generate a report of the one or more potential spearphishing targets and the threat level associated with the one or more potential spearphishing targets.

2. The system of claim 1, wherein the information from an organization comprises a list of employees, contractors, and consultants associated with the organization.

3. The system of claim 1, wherein the additional information is received as a result of one or more automated searches.

4. The system of claim 1, wherein the additional information comprises at least one of profile information associated with the one or more potential targets, information from a website associated with the organization, and information from professional and social networking sites

5. The system of claim 1, wherein the threat level of the spearphishing attack is ranked according to organizational security interests and preferences.

6. The system of claim 1, wherein the one or more processors further comprises:

implementing at least one security measure to protect against a spearphishing attack.

7. The system of claim 6, wherein implementing the at least one security measure comprises minimizing disclosure of publicly available information associated with the organization.

8. The system of claim 6, wherein implementing the at least one security measure comprises enhancing a security posture of the one or more potential spearphishing targets, wherein enhancing a security posture comprises at least one of requiring additional authentication factors, providing security monitoring, and limiting functionality of devices or machines associated with the one or more potential spearphishing targets.

14. The method of claim 1, wherein the method further comprises:

implementing at least one security measure to protect against a spearphishing attack.

15. The method of claim 14, wherein implementing the at least one security measure comprises minimizing disclosure of publicly available information associated with the organization.

16. The method of claim 14, wherein implementing the at least one security measure comprises enhancing a security posture of the one or more potential spearphishing targets, wherein enhancing a security posture comprises at least one of requiring additional authentication factors, providing security monitoring, and limiting functionality of devices or machines associated with the one or more potential spearphishing targets.

20. The system of claim 1, wherein predicting the one or more potential spearphishing targets is further based on additional information from profile information received from at least one of a professional and social networking site, an organization'"'"'s website, or a third party data source.

9. A method for predicting and protecting spearphishing targets comprising:

identifying, using at least one computer processor, one or more potential spearphishing targets based on information from an organization;

receiving additional information associated with the one or more potential spearphishing targets and the organization from publicly available sources;

determining a threat level of a spearphishing attack on the one or more potential spearphishing targets based on the information from the organization and the additional information; and

generating a report of the one or more potential spearphishing targets and the threat level associated with the one or more potential spearphishing targets.

10. The method of claim 9, wherein the information from an organization comprises a list of employees, contractors, and consultants associated with the organization.

11. The method of claim 9, wherein the additional information is received as a result of one or more automated searches.

12. The method of claim 9, wherein the additional information comprises at least one of profile information associated with the one or more potential targets, information from a website associated with the organization, and information from professional and social networking sites.

13. The method of claim 9, wherein the threat level of the spearphishing attack is ranked according to organizational security interests and preferences.

17. A non-transitory computer-readable storage medium storing a computer program of instructions configured to be readable by at least one computer processor for instructing the at least one computer processor to execute a computer process for performing the method of claim 9.

18. A system for predicting and protecting spearphishing targets comprising:

one or more processors communicatively coupled to a network, wherein the one or more processors are configured to;

identify new information of interest associated with an organization;

predict one or more potential spearphishing targets associated with the organization based on the new information of interest; and

generate a report of the one or more potential spearphishing targets to protect against spearphishing attacks.

19. The system of claim 18, wherein the new information of interest associated with an organization comprises at least one of a product line information, a press release, organization sector information, current world news, information associated with recent domestic or international security breaches, merger information, organization rumors, and organizational announcements.