When Security Defense Mechanisms Don't Work Turn to Training and Education

Has your organization been the victim of a spear phishing attack?  If so, you’re not alone. A survey sponsored by Cloudmark, found that of the 300 U.S. and UK information technology (IT) decision makers who participated, 84% of them have had a spear phishing attempt hit their organizations. Of those, 28% of the attackers actually made it through their security defense mechanisms.

How does it happen? The human element will always be a weakness, but also the first line of defense for combatting any type of phishing. Jim Stickley of Stickley on Security says it starts with the employees and the email they receive. Where they check their email makes no difference. He said, “Employees can check it at home or at work, using a client or in a browser window and the end result will be the same if they click on a malicious link or provide sensitive details in a form that pops up.” He went on to say that “If you don’t educate them on how to identify these attempts and how to handle them, the hackers will inevitably get through.”

While many layers of defense such as firewalls, IPS, anti-malware is important and should certainly be part of a comprehensive security strategy, making the effort to teach everyone who is allowed on your company’s network how to avoid letting loose malware from email messages, should also be one of the highest priorities for anyone in charge of corporate IT.

There are many ways to accomplish this, including creating your own training and education programs. These allow you to structure it however it will work best. There are also many companies who provide programs as a service as well. In some cases, these can be a better option and not add to the workload of a likely already over-burdened IT staff.

Once a training program is in place, make sure to test the staff to see how it’s working. Don’t forget to include any contractors that may be working with you in your training and testing efforts.

Don’t forget to have a thorough plan for connecting personal devices to the network that includes requiring anyone who joins to have anti-malware applications installed on all devices they use at the office. While these won’t necessarily prevent spear phishing, they may catch malicious attachments before the user has a chance to open them.

Finally, make sure you have an incident response plan (IRP) written out and tested. Make sure to review and updated it at least annually as part of your overall security plan. An IRP should include names and contact information (don’t forget after-hours contact details) along with specific role definitions for each person participating.

Remember that survey mentioned before? Ninety percent of those who responded to it said they had seen spear phishing attacks in email messages. Forty eight percent saw it in mobile platforms and 30% via social media. The financial news isn’t great either. The financial impact on businesses who are victims was an average of $1.8 million. That doesn’t consider the hit to reputation and lost business as a result of a data breach, the hit to the stock price, and loss of employee productivity.

The top targets of spear phishing are IT staff at 44% and those in finance (43%). A bit further down are sales staff (29%), CEOs (27%), and CFOs (17%).