One of the easiest way is again to fall back on the 2^nd factor of verification. Many employees are worried that calling the boss back to ask what he has just said would make them look stupid, but this is an area where both the senior management teams and the rest of the employees should be well educated and made into a process that must be followed. If the employee feels the CEO / manager is not responding to the questions in a natural way or the communication was mostly one-way, he or she should raise the suspicion and call them back afterwards to validate and can directly mention that just as a form of due diligence, they are double-confirming the details of the call earlier citing the common occurrence of such attacks, and this culture or practice should be well encouraged and appreciated by the management of the company.  Hence, from the first place, all the staffs in the company including the senior management need to have a better awareness level in cyber through training, and initiatives like email and voice phishing campaigns should be amalgamated into the company’s standard IT Security procedures. We have initiatives like Athena Dynamics Academy (ADA) with the main mission on helping companies secure the people perspective.

Additionally, threat intelligence services that help to monitor if anyone is targeting the company and generate alerts if there are any breaches or targeted attacks could be very useful in preparing and anticipating against upcoming attacks.

From the technology angle, using zero-trust technologies such as Content Disarm & Reconstruction (CDR) for non-detection based file cleansing for all incoming files including emails, USBs and files downloaded from the browsers would be highly effective since it addresses the cause (the APT) and not the effect (the context sensitive phishing). For example, anyone can simply send a perfectly normal looking picture that could be embedded with malware using steganographic techniques. This would easily be missed by many detection-based mechanisms because the malware content would be encrypted by steganography and hence, will not be visible to these solutions whereas CDR, by default, would be able to effectively render the malware un-useable by playing around with the innate structure of the file itself.

Other notable zero-trust technologies such as isolation and containment both on browser and windows OS level, as well as strong network monitoring tools to be protected against malicious traffics, will also help in making sure that necessary protections are in place and would reduce the chances of employees being phished and breached (or even against insider threats from disgruntled employees).

Making sure an organization is cyber secure is never a simple task, especially when highly sophisticated technologies like deepfakes come into play. It is always about covering all three dimensions of people, process and technology. Most organizations have certain level of process and technologies in place but people are still the weakest link and as such all of us, like the guys from the dark side, should step up our game and making sure that everyone in the company has access to updated cyber awareness knowledge, at least at the most basic level.