Employees Still Fall For Phishing At Alarming Rates

A recent report from Wombat Security shows how important it is to conduct continual training regarding phishing; not only for the traditional email type, but also about all the various forms a phishing attack can take. For example, the report, State of the Phish^TM Report, found that while many know what phishing is, only 16% know what smishing is. Do you know?

Smishing is simply phishing via text message. Vishing, on the other hand, is when a phishing attack is performed using a voice communication; in other words, using a telephone. An example of vishing is the infamous tech support scam, where a caller phones you up out of the blue to tell you there is a problem with your computer. Fortunately, he or she is more than happy to help you fix it for a fee you can pay with your payment card, conveniently right over the phone. You shouldn’t do this. If you don’t initiate the call, don’t provide payment details to anyone.

But back to the report. Of the 10,000+ security professionals who responded to a survey, 76% of them said their organization saw a phishing attack in 2017 and 45% saw a vishing or smishing attack. More than half (53%) were spearphished.

Spearphishing is a targeted form of phishing, where the attacker uses very specific information about the intended victim to try to get them to divulge sensitive information or perform some function they otherwise may not. Often, the hackers will find the information they need for this attack from social media posts. They also will frequently target those working in human resources or accounting departments, posing as an executive who claims to need sensitive information, such as what is on a W-2. Or the thief claims to need money wired somewhere quickly, which happens to be into the account of the criminal.

Training related to phishing increased from 92% to 95% in 2017. That’s great news, but even so, only 61% of millennials knew what phishing was. Compare this to 77% of those over the age of 55. Ransomware awareness was even worse. Only 46% of technology users know what it is. What is it? It’s when malware holds a victim’s data and/or device hostage until a ransom is paid. The amount varies and often it’s requested to be paid in cryptocurrency, such as Bitcoin. That’s so it’s harder to trace.

Unfortunately, 49% of the respondents reported that once they were hit with a successful phishing attack, they were subsequently hit with a malware infection.

It’s important to continue to perform awareness training on a continual basis. Don’t just stop at once per year. Cyberthreats evolve throughout a year and over years. Nothing stays static, so continuing to get the message out to users in your organization should be one of the top goals. Just because a phishing attack is moving at one point, doesn’t mean a brand new one won’t show up the next week, or even the next day. Keeping employees sharp on the threats is one way you can protect your organization from a successful phishing attack.