PROFILE
Company: Thermal Structures
Business activities: Provider of insulation and composite products for aerospace, industrial, and other applications.
Employees: 200-500
Founded: 1951
Headquarters: Corona, CA
Jerry Brantley, Jr., director of information technology at Rolls-Royce supplier Thermal Structures, spends an hour or two each day checking for infiltration attempts, reading industry reports, and working on prevention tactics, such as employee training.
Q: Is the most significant threat to Thermal Structures a complex hack, or is it an inattentive employee fooled into clicking on a link?
J.B.: Most of the issues I've been dealing with lately are us testing our users and them failing. It’s not so much anybody from the outside getting in. Our firewall is next-generation. But employees seem to fail a lot on phishing email tests: “Here’s a document from your HR department. We need you to sign it and open it.” And they open it, without even really looking. Some of the issues may be a language barrier, because especially on the production floor, English is a second language.
Q: Any new twists on scams?
J.B.: Text messages. We probably had seven or eight reports from people here recently saying somebody tried getting gift cards, pretending to be our operations manager. Emails lately have been more toward, "The dress code has changed." We got one recently: "The fire evacuation plan has changed. Please open the document and review it." They’re trying all kinds of different angles.
Q: Tell me about your defenses.
J.B.: The best defense strategy is top-notch education and top-notch mitigation tools. I have training sessions with management so they can pass on strategies for incoming emails. We're also moving to Microsoft 365 Government cloud for email, and we’re putting Ironscales in front of it for phishing detection and malware detection.
Q: Yet technology doesn't solve the problem.
J.B.: Not completely. As fast as we can detect them and put in place something to stop them, they're figuring out another way to try to get through. It’s the chess game we play.
Q: That’s why education is crucial. You’ve kept the company safe, yet your employees fail your tests. Are your tests harder than the real world?
J.B.: They’re probably harder because I can make them look really valid. In the real world, emails come in from Brazil or Ukraine. I’ve been able to get the point across that you can look at an email and see it’s somebody trying to speak English, but it’s their third language. You start reading it, and it doesn’t make sense.
Q: Some companies have fallen prey to hacked emails from legitimate addresses saying things like, "Our bank account has changed, please send the money here." What’s the right defense?
J.B.: One thing I teach the accounting department is if you get anything like that, you need to get on the phone and verify everything. Don't take email at face value.