For similar reasons, a general counsel or staff attorney at an organization is also a good target, especially with an Adobe PDF attack. Attorneys regularly exchange large PDF briefings between one another and between companies. It wouldn't be a stretch to imagine sending a mock cease-and-desist e-mail message from a spoofed address of your favorite influential intellectual-property law firm and include a PDF with a malicious payload. The attorney wouldn't think twice about opening such a message; and once the payload within the PDF is executed, the attorney's machine is effectively "owned" by the attacker.
Don't Take the Bait
Spear-phishing attacks aiming for competitive intelligence or corporate espionage are likely to have a custom-tailored message (e-mail, IM, tweet, and so on), such that the victim is more likely to take the bait. A top nuclear physicist at a research institution is unlikely to follow through on a link advertising replica Rolex watches or natural male enhancement, but if the message is inviting the victim to be a speaker on a panel at a well-known nuclear physics symposium, the bait will be all but irresistible.
Although you might think that in 2010, most users (and especially tech workers) would be suspicious of any password reset or messages declaring that "we are improving our security," a stunning number of them will still be fooled by such schemes. My company, Special Ops Security, as part of its assessments with organizations and government agencies, will run controlled experiments where we intentionally phish targeted individuals at a company and track both click-through and captured passwords on an encrypted Web site.
Two colleagues of mine have even started their own self-service portal for CIOs to run mock "spear phishing" of their employees at PhishMe.com. It's a particularly eye-opening exercise, and I highly recommend it.
Use Unique E-Mail Addresses to Keep Password Reset E-Mails at Bay
If you don't believe that you would fall for a targeted e-mail discussing your upcoming new product or a malicious PDF with a class-action settlement notice, there is the ever-present category of password reset and social networking notification messages. Most Websites, as an unfortunate necessity of large scale, have a "forgot password?" function that sends e-mails to allow you to obtain access to your account.
Additionally, we are trained to expect notification e-mails from sites informing us of new friend requests, or photos of ourselves that others have posted. This is a particularly enticing proposition for the human psyche--how can I resist clicking on "have you seen this hilarious picture of you from last night?"