INKY | Industries | Manufacturing

Why And How Do Phishers Target Manufacturing Firms?

Although manufacturing in the United States has been in decline for years, the sector still represents nearly a trillion dollars of GDP and 6% of the economy. The technological sophistication of durable manufacturing firms varies greatly depending on the goods they make. Semiconductor fabrication is such a precision process that the cost of the equipment involved dwarfs the labor input. Pharmaceutical and some chemical processes require highly complex control equipment. Smelting is a pretty basic process, although some exactness in timing and temperature is needed for delicate alloys. Food production involves the meticulous setup of robots but is highly repetitive. Depending on how connected each manufacturing firm is, it may deal with a wide variety of suppliers, channels, and partners.

Phishers target the weak points in the manufacturing sector: less sophisticated firms; firms that transfer high-value products, subassemblies, or inputs; and firms that interact with a wide variety of outside partners, with whom they may be more or less familiar. Less sophisticated firms often have less protection, older, outmoded IT infrastructure, and the less internal awareness of phishing dangers. Firms that deal with high-value inputs are attractive to phishers for the size of the prize. Complex ecosystems invite account takeover attacks from compromised partners. A combination of access and value drive phishers to target manufacturing firms’ email systems. Landing successful phishing exploits via an unsuspecting employee lets phishers invade the entire network and drop their payload, which may be a ransomware attack, a credential harvesting operation, or a means to exfiltrate valuable intellectual property — or even money.

Request a demo.

How Are Manufacturing Firms Currently Protected?

At the moment, most manufacturing firms deliver their email through either their own on-premise Exchange server or a secure email gateway (SEG) provider — including but not limited to Microsoft, ProofPoint, and Mimecast. These services have only rudimentary protection against phishing. Phishing attacks are like nuclear missile sallies. It’s not enough to stop 99% of them; it has to be 100%.

In the tight window between when an email server receives a mail and when it has to deliver it to a recipient’s inbox, the SEGs can only examine the universal email tests (DKIM and SPF), take a cursory look at the nature of the message with regular expression matching, and look up the sender’s address on whatever bad lists they have on the shelf. With this limited examination they can't spot the phish. And this is best case. Most can’t run their full analysis stack on every email because it takes too long.

Request a demo.

How Does INKY Stop Phishing Attacks on Manufacturing Firms?

INKY sits downstream from the SEG and spends less than two seconds looking at an email before dropping it in the recipient’s inbox. From this privileged position, INKY catches all the phish that get past the SEGs (proof that they’re not catching them and we are). Recently, INKY processed its billionth email. It's seen a lot of phish they missed.

What INKY does during that two seconds is release a swarm of mathematical models on the email’s raw HTML code. They all operate simultaneously on it, testing for this and that (our secret sauce), and formulating an “opinion,” which is in fact a number on a scale, representing the results of its particular test.

Request a demo.

Reduce user clicks with real-time phishing awareness training.

One more model takes the output of all the rest and comes up with an overall score that represents how bad INKY thinks the email is. This value is interpreted to create a colored banner, which is inserted in the email before it's passed on to the recipient’s inbox (and pulled back out of any reply on the way out).

Beyond a certain threshold of badness, the banner is red. Suspicious, maybe spam, but not necessarily outright dangerous? Yellow. Neutral gray means no thresholds were triggered.

The banners also have feedback links that allow the recipient to correct INKY (e.g., That’s not spam; that's my Wall Street Journal subscription!). When an authenticated INKY user designates something spam in the feedback dialog, they have the opportunity to block the sender — or even the sender’s entire domain, a favorite feature of many customers.

Request a demo.