eCompany participates at Identity Summit

The conference is aimed at educating Middle East enterprises about the latest technologies, strategies and tactics in both physical and logical identity authentication and management.
Rashed Al Abbar- eSecurity Product Manager,eCompany spoke to attendees from across the region on the practice of phishing which refers to fraudulent spam emails and websites disguised as trusted brands intended to trick consumers into divulging personal and financial information. This is then used for identity and financial theft. He also gave the audience an insight into measures they could take in protecting themselves from phishing threats amid growing incidents of phishing threats in the Middle East.

Rashed gave attendees an insight into various types of phishing scams ranging from mass emailing techniques to Proxy Phishing whereby a fake web site acts as a proxy for the real web site and covertly log credentials that are not encrypted using SSL(Secure Software Layer). Other methods highlighted included a Silent Logger scam where a a fake phishing web site is established to record input data from the user (such as usernames and passwords) which silently log thems and then forwards the user to the real web site.Giving a graphical representation of a phishing website, he educated participants to look out for suspicious URL where there is no 'https' in the URL and the absence of a 'lock' icon in the status bar which would normally indicate that the website was secure.

Expanding on the harmful effects of phishing, Rashed said, 'Companies need to recognize the threat and take effective steps to secure their infrastructure against phishing at the risk of being perceived as irresponsible and thereby diminishing the value of their brand and affecting shareholders. There could also be a possibility of liability for failure to exercise due diligence in protecting their trademark.'

In the Identity Management sphere, eCompany offers various PKI based products and services and is a regional leader in the PKI domain. Running the region's first commercial Certificate Authority, eCompany today offers a comprehensive range of solutions aimed at providing a secure electronic commerce environment. These include a range of digital certificates, PKI over Smart Card, Secure Messaging, Secure Access Identity Management Solution, Electronic Approval, and Managed PKI.

Financial services, ISPs and retail companies are the most targeted sectors for phishing attacks.

Expounding on the possible solutions for countering phishing, he urged the creation of an effective awareness campaign as a first step to educate general Internet users as well as corporate users. Possible measures recommended were country-wide policies and countermeasures through a central bank policy for two-factor authentication and blocking at an ISP (Internet Service Provider) level. This is currently already happening in the UAE through the Etisalat proxy filter. Technical measures to control phishing through Multi-factor user authentication, Server authentication using PKI/SSL Certificates and by tracking information transmitted on personal and corporate networks were also recommended by Rashed.

In terms of reducing the risk, Rashed urged organizations to monitor potentially malicious activity in terms of web site usage and Domain registrations. He also recommended authenticating email messages so unauthenticated messages can be discarded. He urged participants to be vigilant in detecting the unauthorized use of trademarks, logos and other proprietary imagery on fake websites. Improving the security patching infrastructure to increase resistance to malware and the use of public key infrastructure (PKI) were additional measures recommended to minimize phishing attacks.