Impersonating Trust: How Threat Actors Leverage Familiar Systems to Breach IT Defenses

This IDC Perspective discusses phishing and other social engineering attacks that put personnel in your organization in direct contact with sophisticated adversaries on a regular basis. These attackers use knowledge of your organization and the systems it uses to craft pretexts that coerce employees into divulging sensitive information and credentials. Threat actors are increasingly using tactics where trusted personnel and internal and third-party IT systems are impersonated as part of these pretexts. These deceptive schemes turn the trust your employees and customers have in your IT organization against them, with often devastating results.Addressing this risk exercises all facets of an IT organization's security program. Prioritizing defense against this threat is well worth the effort. Not only does this work put your organization's security posture in a better place against other foreseeable threats, but it can also be a catalyst that fosters a healthy awareness of the paths to success for an attacker and the psychological factors involved in these attacks.This document discusses this evolving tactic and enumerates technical mitigations that can be used on IT and other core infrastructure systems to make attacks of this form less likely to succeed. We also discuss a number of activities that can be used to put these risks in context and identify gaps in your IT organization's security posture."Sophisticated threat actors tailor their phishing campaigns to the responsibilities and workflows of targeted personnel. IT personnel deal with notifications and alerts from systems they manage as part of their daily responsibilities. A well-crafted phishing campaign that mimics a familiar IT system is an effective tactic for bad actors to quickly gain access to sensitive IT credentials and systems," says Joel Sandin, adjunct research analyst, IT Executive Programs (IEP), IDC. "Understanding these attacks, educating personnel, and fortifying IT systems against this threat is well worth the effort."