COLUMN CYBERSECURITY password or other information. They may claim that you have won a prize or are due a payment. They could be posing as a charity or political cause. They may say that they need the information to stop an imminent threat, such as hacking or a virus. They may claim to be someone high up in your organization who urgently needs sensitive information or access to a network, or they may pose as someone from your IT department or from a software vendor and ask for credentials to connect to your computer. Some attacks direct the victim to a website to enter information. What the attackers lack in morals they make up for in creativity. It's important to realize that this is an attack against you and your company. If it's a targeted attack they may even have some accurate information, such as an account number, email address or a password. The information is probably out of date. Criminals sell information from previous data breaches to other criminals to use in their attacks. Types of Phishing Attackers can use multiple methods to contact a victim. Some of the more common types are: * Email phishing-the most common type. An email is sent with a dire warning (you've been hacked!) or an extortion attempt where they claim to have compromising pictures or video of you (note: they do not). Business email compromise (BEC) attacks are a type of email phishing attack where a company executive or other representative is impersonated. They may claim a situation that requires urgency and demand that you take some action (clicking a link, sending them some information) immediately. Their demand probably violates company security policy as well as common sense. The false sense of urgency is to get you to panic and act before thinking. * Smishing-an attack that uses text messaging or short message service (SMS) to execute the attack. A common smishing technique is to deliver a message to a cell phone through SMS that contains a clickable link or a return phone number. * Vishing-term for when the attacker contacts the victim through a voice call. * Spear phishing-targets a specifi c group or type of individual such as a company's system administrator. * Whaling-an even more targeted type of phishing that goes after large " whales " instead of small fi sh, typically targeting a C-level executive. * Search engine phishing-hackers become the top result in a search engine, masquerading as a legitimate website. * Pharming-Internet traffi c is routed to a fake website, which may have malware or may try to gather information. This may affect one person or large numbers of people. One dangerous aspect of this type of attack is that it can happen without any action being F E B R U A RY 2 0 2 3 ashrae.o rg ASHRAE JOURNAL 21 iSTOCK.COM/STEVANOVICIGORhttp://www.iSTOCK.COM/STEVANOVICIGOR http://ashrae.org