Protect Your Business From Whaling Attacks

Whaling, the hunting of whales for food and oil, was once a global industry that was conducted on a large scale by seafaring nations in pursuit of the giant animals that seemed as limitless as the oceans in which they swam. But since the mid-20th century, whaling has dramatically declined as whale populations began to decline in a way that would have shocked and dismayed any seafarer in the past.

The history of whaling dates back millennia and there have been whale hunts by Native Americans, Norsemen, Japanese and Europeans throughout time. During the 19th century, whaling became an economic force that fueled the American economy, particularly following the War of 1812.

A major concern for many people is that whaling practices negatively impact marine ecosystems, and even degrade habitats. As a result, the IWC has issued a moratorium on commercial whaling for seasons 1986-90.

There are several reasons why whales are killed, but the most common is for food. The meat, skin, blubber and bones are used to make foods, furs, tools and carvings. The oil from blubber is often burnt for fuel, and the bone ash is used as firewood or to build homes.

As a result, there are few places on earth where whales are not hunted today. However, the IWC believes that it is wrong to kill these majestic creatures without any purpose in mind.

To reduce the likelihood that your business will be targeted by whaling attacks, invest in security awareness training for senior management and key staff. Educate employees to look at the domain name of the sender, confirm requests over a separate channel or in-person and avoid opening unsolicited attachments.

Conduct mock whaling attacks regularly to test your employees' ability to detect whaling attacks and prevent them from happening. For example, a Chinese cyber crime gang recently infiltrated toy manufacturer Mattel's network and conducted covert monitoring of their internal procedures, protocols and corporate hierarchy before impersonating a high-ranking executive.

Alternatively, an attacker may target a low-level employee who can provide a company's financial data. This can be a relatively easy target, and if the person receiving the threat is a C-suite executive, the attack could be devastating.

For example, a threat actor might send an email stating that a large invoice has been received by the company and needs to be paid as soon as possible. The attack might also include a phone call to a senior executive that seems authentic and believable.

If the request is to wire money to a bank, the attack might be more likely to succeed. This is because many C-suite executives work long hours and are exposed to high levels of stress, which can increase the chance of them being duped by a whaling threat.

Whaling is a complex and often highly technical industry, which means that it is difficult to determine whether an email or phone call is a whaling attack or not. For example, a CEO fraud email might direct it at a lower-level employee or vice versa, which makes it hard to identify and track.