Spear-phishing And Ransomware Are Still Big Threats To Businesses

In 2016, the cybersecurity company, Cloudmark commissioned a study of 300 IT decision makers and found some interesting statistics. Only 25% of them were confident that the users they supported would be able to identify a phishing attempt. Considering the amount of information available on how to identify those, it’s disappointing. When you add the fact that the same study found that a spear phishing attack costs companies $1.6 million on average, it’s absolutely alarming.

Spear phishing is on the rise. Some speculate it’s the new ransomware. Both, however, are on the rise and because ransomware can be purchased as a package deal in the form of ransomware-as-a-service, it’s easy for criminals to get into the business.

Spear phishing, however, can do its own damage. This form of phishing involves social engineering and human interaction. While ransomware sometimes gets caught by security tools, spear phishing often does not. That’s because it just needs to make it into a user’s email inbox.

Spear phishing is a very specific type of attack where cyberthieves research the targets before casting the line. It was responsible for the successful attacks on both Sony and Target a few years ago, as well as many others. It actually set the WannaCry attack in motion earlier this year. Spear-phishing is one of, if not the single biggest concern of technology and business managers.

What can happen if spear phishing is successful at a company?

• Stock prices take a dive
• Many man-hours are spent trying to resolve it
• The loss of revenue from returning and loyal customers can be significant and is very difficult, if not impossible to determine
• Reputation is harmed

Ransomware is also a danger. Where spear phishing is usually a lead-in to a bigger crime such as to install malware, steal data, or spy on the user or company, ransomware is often the star of the show. In a 2016 study by Kaspersky Lab, 43% of respondents admitted they did not know what ransomware is. Toward the end of 2016, ransomware attacks were hitting businesses every 40 seconds and consumers every 10 seconds.

Researchers are finding both attacks are evolving and becoming more sophisticated.  A method called doxing is being seen in ransomware. This is a technique used by the criminals to collect ransom from those who refuse to pay it. All kinds of phishing are becoming more difficult to detect and with the popularity of social media, the cybercriminals can gather all kinds of information for a successful spear phishing attack.

However, there is hope. Artificial intelligence, heuristics gathering, and machine learning can all help. But the best defense is awareness training and education. A comprehensive program that addresses these evolving threats is the key. Users should be exposed to material on a continual basis so that they can gain and maintain a level of awareness that will help your organization reduce the risk of a successful attack harming or taking down your organization.