Once again, research shows that human beings are still the weakest link; when it comes to phishing, that is. Osterman Research found that email is still the top way that networks become infected with malware and this has been the case since 2014. That is because the attackers phishing for information have figured out that those opening the email messages they send are indeed human and can be tricked.
Before you get all excited and think that is just a load of hooey, keep in mind that psychology plays a very large part in phishing. Humans can be fearful, empathetic, and excited, just to name a few emotions hackers play with when trying to get confidential information. They use email phishing more than other types for a very simple reason: They can craft very detailed email messages to very specific targets using psychology combined information they find out about their targets. This results in a lot of success.
Because of this, it should be a priority in an organization’s security strategy. There are a few items that should make it at the top of the list.
2
Email with malicious intent has been found repeatedly to make it past filters and make its way to workers’ in boxes. This means there should be several barriers of entry before that point.
2
Most people attach their work email addresses to business social networking sites. Because of this, those can be dangerous to the company. LinkedIn is particularly dangerous not only because people do link their work email addresses to their LinkedIn accounts, but also because the information on those profiles are specific to their work and can be used for spear-phishing.
For these reasons and others, consider putting into place a comprehensive social networking and social media policy for anyone connecting to your network to limit risk from these sites.
2
For an attacker, spoofing an email address is relatively simple. In research conducted by KnowBe4, 82% of the servers were misconfigured and allowed spoofed emails to make it inside.
A common spoofed email messages for phishing appears to be from “IT” and will claim that users need to click a link to update email credentials or apply a patch. This works amazingly often.
2
Criminals are more crafty and sophisticated than ever. Typical tools installed at the perimeter for protection are not nearly enough anymore, even if they are several deep. A comprehensive training program is mandatory these days. It should not only train on cyber risks, but it should also test knowledge by simulating phishing and other social engineering types of attacks.
Because it’s fun to know, the following are the top 10 most clicked subject lines for Q2 per KnowBe4:
- Security Alert – 21%
- Revised Vacation & Sick Time Policy – 14%
- UPS Label Delivery 1ZBE312TNY00015011 – 10%
- BREAKING: United Airlines Passenger Dies from Brain Hemorrhage – VIDEO – 10%
- A Delivery Attempt was made – 10%
- All Employees: Update your Healthcare Info – 9%
- Change of Password Required Immediately – 8%
- Password Check Required Immediately – 7%
- Unusual sign-in activity – 6%
- Urgent Action Required – 6%
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
