VIP Impersonation and High-Value Targets

Attackers impersonate senior management, board members, and other well-known people to launch multi-step targeted attacks against your organization. Register these VIPs to increase protection and improve visibility. To do so, log in to xorlab Security Platform and navigate to Settings → Admin → Lists and then:

1. Register the first and last name of each of your VIP in the Basic / VIP names list by clicking the Add entry button below the search input box. This helps to identify Display Name Impersonation Attacks.
2. Make sure to add the corporate email addresses of your VIPs to the Basic / High value targets list the same way as with VIPs names. This allows the platform to perform more rigorous filtering while maintaining a risk-based, resource-efficient approach for the rest of your organization.
3. If your organization allows the use of private email accounts for basic information exchange, then make sure to whitelist private email addresses of registered VIPs in the Whitelist / VIP sender email whitelist:

​

Exposed accounts

Some people inside your organization might be more affected by malicious email than others (for instance, because they receive emails sent to contact@yourcompany.com or because their email is publicly available). To increase spam and phishing protection for them, register their email addresses in the Basic / Exposed accounts list:

​

Exposed public contacts

To this list, you can the add the email addresses of your organization that should be subject to less aggressive filtering. This will decrease spam and phishing protection for them, but can be useful for certain public mailboxes where you expect a lot of suspicious or malformed emails that should be let through. There is also a related regex list called Exposed public contacts (regex), which makes it handy to assign a group of addresses to be considered as exposed public contacts.