Top Hackers Keep it Simple; Making Education the Best Defense

Sophisticated malware isn’t necessary for completing attacks against sophisticated institutions. Recent hacks against banking and healthcare companies, and even the White House, were successfully infiltrated using everyday malware. It’s basic, and it’s easily available to criminals on the cyber black market. Cybercrooks easily affect systems using clever methods, not necessarily using hi-tech malware. Incredibly, the White House hack on a non-classified network relied on a video about chimps while installing malicious software on amused but unsuspecting employees’ computers.

Zeus bots in particular pose threats aimed at financial institutions and their clients. Stealing financial information is the reason Zeus bots were created, with many Zeus trojans leading the way to successful cyber hacks. In 2014 FireEye, a threat-intelligence firm, reported that 60% of attacks on financial institutions around the world were successful thanks to Zeus malware such as Dridex and Dyre. Again, simple malware did the job. 

Employee and customer education is again proving a great friend for stopping malware infections. But what to do when common techniques like spearphishing are working, even on employees who are highly trained? A combination of education and technical vigilance appears to be the best answer to preventing a malware infection.

There are a few ways to integrate education into your organization:

• Stay aware of the latest and greatest types of malware. This provides employees and institutions with their own layer of simple but effective security.

• Arm employees with the most common types of phishing scams and other ways of being conned.  This may help to avoid malware infection in organizations in the first place.

• Remain vigilant and provide ongoing education.  These go hand in hand in preventing infection and exploitation.

There are programs readily available for educating employees about cyber threats at budget-friendly rates, which will alleviate the need to tie up valuable resource time creating programs of your own. When choosing one, make sure it meets your criteria for success and remember that sometimes, simple is better.

Further strategies may include sharing information about malware and other cyber threats with other companies and implementing top-level domains, or TLD’s.  These add another level of protection. A TLD such as “.bank,” requires more vigilant levels of security for institutions that belong.

The ways for companies and institutions to provide internal and external malware prevention is an ever-changing landscape. The simplest approaches to fight malware may be the best place to start. As we already know, cybercrooks have been successful sticking to the basics. Why shouldn't it work for everyone else?