Businesses More Aware of Cyber Risks but Half Forget About Phishing and Social Engineering

There's finally some good news about cybersecurity. Businesses are more aware of the risks and according to the Ponemon Institute, the number of them that now have a data breach response plan is up from 61% in 2013 to 86%. This is likely due to the widespread coverage the data breaches like the ones that were disclosed by Yahoo last year receive from mainstream media. That one resulted in data being accessed of over 1.5 billion people. In fact, it is estimated that over 1.9 million records are compromised every single day. That’s a lot of potential fraud victims.

The beginning of each year is a fantastic time for all organizations to review their entire cybersecurity plans. While ensuring that comprehensive data breach response procedures are included is high priority (after all, it’s not a matter of if your network will be breached, it’s when), don’t forget to include awareness training.

Many attacks start with phishing in some form. So making sure your plan has an awareness training program is no longer merely an option. Anyone with access to your network or physical location can be a potential weak link, including third parties. It should be a year-round, continuous program that includes a variety of learning tools and objectives so that people who embrace all learning styles are included. The Ponemon Institute reported that less than half of the organizations surveyed included phishing identification and avoidance and social engineering in their cybersecurity trainings. That is a problem because these are at the foundation of nearly all attacks, including the rising W-2 fraud and physical security breaches.

On the rise over the past year was tax fraud; particularly W-2 fraud. This caught out companies such as Seagate Technologies, Ubiquiti Networks, and Snapchat resulting in the loss of sensitive W-2 data. According to Experian, its Data Breach Resolution group handled over 70 data breaches per week that were somehow tied to W-2 fraud during the 2016 tax season. Most of the time this starts with some type of phishing; usually with a simple, but very targeted email. It tricks someone with access to that data into sending it to a cyber thief. The information needed to perform these spear phishing attacks is often found on social media and professional networking sites.

Physical security might be old news, but these attacks still happen. In 2016, the U.S. Department of Health and Human Services (HHS) was a victim of a physical breach when someone stole portable hard drives. The health information of over five million people was accessed. Something similar happened to health insurer, Centene. Hard drives were lost that contained sensitive information on around 950,000 people. Often this happens with something as simple as someone posing as pest control, HVAC, or other service provider and convincing an employee they have a legitimate need to be there. Jim Stickley of Stickley on Security has donned such disguises and stolen USB drives, paperwork left sitting on printers, and cell phones. He also showed how he could load malware onto a Windows 10 system in less than one minute, even if it’s locked.

As we approach the first quarter, take some time to review your cybersecurity policy, update it, and then do a test to make sure it works. This process should be a part of your routine every year. If it is, you are one step closer to mitigating the cybersecurity risks your organization faces.