- [Jeff] How can spearfishing affect our everyday lives?

- So spearfishing's been in the news back with the Mueller Report we talked about it. It's been out again, this time with more details coming out on the Florida voting system compromises. Again, the perpetrators used spearfishing. Spearfishing is targeted email, targeted deceptive email practices. This can affect any company, not just election stuff, any company so we're gonna talk about this again. The key here is end user training. There's no way to fully stop spearfishing attacks at the edge of the network. There's no amount of scanning of inbound email, there's no amount of anything like that we can do on a technical side to fully stop spearfishing. It has to be a full-staff effort to be able to identify spearfishing emails and they're tough. These guys are getting really good at compromising your message traffic, looking through that message traffic and crafting stuff that looks incredibly realistic and looks like it comes from the internal source. For our clients we do a double number of things to help with this. We can put banners on inbound mail so you can tell if a message originated from outside the organization. We also do a ton of end user training. Training can take the place, it can take place in a classroom setting, it can take place in a online web-based trainings platform. We recommend using all the above and it has to be something that's integrated into your company culture and is something that people get used to as a regular course of business. You know, one of my favorite things around here too, is to go and phish those clients, friendly phishing, to make sure that those lessons are being taken to heart and that your staff is learning how to do those, our guys are getting really good at creating these as well. Just to see with kind of learning path your company is on. So make sure that you're focused in on that. Have some kind of at least some computer-based training program around phishing and spearfishing, in particular. And have those controls around financials that use another method other than email to make sure that those transfers of funds are authorized by the correct people.