I was thinking about the social engineering techniques of spear phishing especially whale phishing and I asked myself the question:
What is the benefit of the C-suite of an organization requiring high level access privilege to computer systems?
The executives has no need to access backend server infrastructure since they are only consumers of the technology.
How does infecting or installing ransomeware on the C-suite devices affects the other work force?
To mitigate and minimize the impact of phishing and ransomware attack on our vulnerable users, we should serious consider applying the Zero Trust strategy:
- Utilize least privilege
- Separation of duties
- Accountability
Let me break it down each concepts and demonstrate how to apply it.
Least privilege – it is the technique of assigning only the required rights or permission to perform only the task done by the individual.
Separation of Duties – it is sharing or dividing the task between two or more individuals for it to be complete. It is a method that is applied in the financial industry to prevent fraudulent activities. This principle is similiar to how MultiFactor authentication works to log into a systems. You need more than one components to gain access to the system.
Accountability –
It is an important considerations that the organization must be protected to prevent malicious attackers negatively affecting the business operations. The old saying is “Prevention is better than cure” especially when it comes to the organizations reputation which is sometimes ireversable and restoring stakeholder’s confidence.
is a method to migitate the impact of these vulnerable targeted users.
As security professionals, we may have to assess the way our users operate to determine the best mode of action.
Please share your thoughts and comment…
IT Wiz Technology Blog 