Unlike regular phishing, which aims to hook anyone willing to bite (think: financial appeals from a Nigerian Prince), spear phishing attacks target a specific individual or organization for a “long con.” TechTarget offers the following spear phishing attack definition:

“Spear phishing is an email-spoofing attack that targets a specific organization or individual, seeking unauthorized access to sensitive information. Spear-phishing attempts are not typically initiated by random hackers, but are more likely to be conducted by perpetrators out for financial gain, trade secrets or military information.”

Spear phishing attacks are significantly more successful than generic phishing emails. According to a report from FireEye, “spear phishing emails had an open rate of 70 percent … 50 percent of recipients who open spear phishing emails also click on enclosed links, which is 10 times the rate for mass mailings.”

So, why are targeted phishing attacks so successful?
Hackers spend a lot of time and effort planning their spear phishing attacks. They design their fake emails to look as legitimate and authentic as possible to trick the intended victims. This means using imagery/graphics, design, language, and even email addresses that can pass as real when minimally inspected. Spear phishing emails are personalized and use specific information to lure in victims. Sometimes, these messages are tailored to look like they are sent by a manager or high-level executive. They also can be customized to appear to come from a company-trusted vendor. They don’t resemble traditional mass phishing emails, so the messages are often missed by spam filters and other email protections.

Finally, rather than trying for a quick attack, spear phishers are patient with their targeted attacks. They often use multi-stage attacks that involve malware downloads and data exfiltration which can take weeks or even months.

Spear phishing attacks consist of three main steps:

1. Infiltration — Directing users to click on a malicious link that downloads and installs malware or leads them to a fraudulent website. Once on the fraudulent website, requests for vital information are made and the phisher can use the collected information or access to log in to the victim’s account.
2. Reconnaissance — The phisher monitors and reads emails to learn about the organization and identify additional targets and opportunities.
3. Extract Value — Using the information and knowledge gained over time, or even using the compromised email account itself, the attacker launches spear phishing attacks.

As mentioned earlier, spear phishing attacks often elude spam filters and other email security solutions. As a result, the only defense against spear phishing is diligence. You must use caution when you receive an email, even if it’s from a supposedly trusted source, that requests you to click on a link or share sensitive information.

ITS will continue to send simulated phishing emails in order to help the campus community learn how to recognize phishing attacks. Training is assigned to those who prove to be susceptible to phishing attacks. If you believe you’ve been targeted by phishing, see Reporting a Phishing Message (How-to).

— Christopher Mielke, ITS

During the past academic year, 432 faculty and staff participated in at least one virtual Bulldogs United in Learning Drake (BUILD) class. These classes assist individuals with learning a new skill, improving their health, or strengthening professional knowledge.

If you missed any of the classes, links to the recorded presentations are available on myDrake. To view any past presentation, click the Human Resources App at the top of the employee home page and then click on Learning & Development.

We are now in the process of planning for our 2021–2022 academic year. Classes may be held in a virtual format, in-person, or a combination this fall. Regardless of the format, we continue to look for ways to assist and engage faculty and staff.

If you have suggestions for topics, or would like to present a BUILD class, email linda.feiden@drake.edu.

— Linda Feiden, Human Resources

Thank you to everyone who tuned in for the virtual Sapphire Awards hosted by the All Staff Council Recognition Committee and Human Resources. The committee recognized the nine groups and 18 individuals who received True Blue Awards throughout the year. One individual and one group are voted on by All Staff Council members to win the Sapphire Award.

Congratulations to Chris Nickell on winning the individual Sapphire Award!
Here is what his nominator had to say: Chris has done the job of at least four people during this pandemic and has done a great deal to enable the success we saw in minimizing the spread of COVID-19 on campus. He worked tireless and countless hours often with no regard to day or night. It’s his tireless dedication that actually served as a motivator to others and inspired many of us to also do our part. 

Congratulations to the Contact Tracing Team on winning the group Sapphire Award!
Here is what the group’s nominator had to say: There have been countless times a member of this team will be working with students late into the evening and on weekends, talking them through implications of a potential exposure or how to navigate various aspects of an isolation or quarantine. I can’t count how many times a member of the Contact Tracing team has worked to keep communications coordinated so that we can make an already tumultuous experience (testing positive for COVID or being exposed to someone) more relaxing and smooth. This team has taken on an enormous task and has done it with excellence, grace, humor, and a servant’s perspective. 

Congratulations to all of the True Blue Winners!

• Lance Berg
• Glenn Clark
• Lynne Cornelius
• Deneen Dygert
• Emily Fleming
• Alice Fynarrdt
• Sara Heijerman
• Alicia Hilligas
• Shannon Hilscher
• Sara Hughes
• Jessica Lang
• Venessa Macro
• Chris Nickell
• Geena Rasmussen
• Joyce Ryerson
• Mich Wieczorek
• Lisa Wyatt
• Ryan Zantingh

Group winners:

• Kris Brewster, Adrick Smith & the ITS
• Contact Tracing Team
• Stephanie Sledge and Athletics
• Ross Hall Custodial Staff
• Jerry Parker & Sharyn O’Connor
• Records Room and Finance Staff
• Jeremy Sievers & Annie Spadt
• National Alumni Scholars Admissions Team
• Facilities Planning and Management & Public Safety

Watch a recording of the event.

— Amelia Klatt, On behalf of All Staff Council