The Devil's in the Details and the DLLs: Your main defenses won't stop targeted attacks. It's the little things that count.

The term "targeted attacks" has succeeded in driving fear into the hearts of security pros, but how do we get to the end of the story, when the plucky townspeople band together behind a courageous leader, grab their pitchforks and set off to defeat the attacks and end their reign of villainy?

The fact is, the criminal who develops a targeted attack is wilier and more patient than the average work-a-day phisherman. He's spent time learning about your organization, about your employees, about your business partners. He's worked out ways to sneak around the major players in your defense—spam filters, firewalls, endpoint security, SSL encryption, up-to-date anti-virus software—and slip in through the tiny cracks.

Thus to thwart targeted attacks you need to find those little cracks and fill them.

Judging by recent targeted attacks in the news, the first place to look is in your Web browsers and any interactive segment of your Web sites. Almost all the most sinister attacks are using malicious browser helper objects, DLLs and snippets of JavaScript to grab HTML form data and transmit it to repositories on criminals' Web servers.

Next, you may need to be a bit more sparing with the information you knowingly, willingly give to the public, particularly on your "contact us" page. Plus you need to keep an eye on what information you may not be purposely releasing to the universe—for example, many targeted attackers are conducting reconnaissance through social networking sites.

You must also devote attention to the humble password, for even it has a big part to play in this story.

Most of all, you need to get those plucky townspeople involved, and to do that you need awareness training—really good awareness training—especially for those who need it most—the finance department, executives of any ilk, help desk staff and customer relations.

In that endeavor, horror stories always help drive the message home; so here are a few doozies to get you started.

By Sara Peters. Excerpted from "The Devil's in the Details and the DLLs," the cover story for the August 2007 issue of the Alert, CSI's member newsletter. CSI members can read the full story here.