Spear Phishing
What is Spear Phishing?
A targeted phishing attack directed at a specific individual or organisation. Spear phishing emails are personalised using information gathered about the target to increase credibility and success rates.
Frameworks that govern spear phishing
What the standards actually require on spear phishing
Requirements naming spear phishing across 4 standards, quoted from the control text.
Threats are untargeted (the ship or company is one of many victims or collateral damage, as with NotPetya, using tools freely available online) or targeted (the company or ship is chosen, often after reconnaissance, with tailored tools).
BIMCO-2.2 · Types of cyber threats →Annual information security training covers incident response, current threats such as phishing, spear phishing, social engineering and mobile security, and emerging issues.
ffiec-cybersecurity-assessment-tool-cat::D1.TC.Tr.B.2 · D1.TC.Tr.B.2 Training (Baseline 2) →Baseline control principles for staffing and training (required of every AI (minimum for a low inherent risk)). Cybersecurity roles and responsibilities are identified and defined;
hkma-cyber-resilience-assessment-framework-c-raf::1.5.B · 1.5 Staffing and training: baseline level →The CCMP addresses detection, containment, response and recovery; the bank takes measures to prevent attacks and detect intrusions promptly, prepares for zero-day, remote access and targeted attacks, and addresses threats including denial of service and DDoS,...
rbi-cybersecurity-framework-for-banks::193 · Para 193: CCMP covers detection, containment, response and recovery for a wide threat set →Questions people ask about spear phishing
What is Spear Phishing?
Why is Spear Phishing important for compliance?
Which compliance frameworks address Spear Phishing?
Where can I learn more about Spear Phishing?
See how Spear Phishing applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.