Successful Phishing at FS-ISAC May Have Been Prevented With Awareness Training

The importance of awareness training in cybersecurity in any organization cannot be over-emphasized. Really. And even if you do provide this to employees or even if you receive it as an employee, a recent incident stresses again how no matter how many perimeter security tools are implemented, it takes just one person to click on a malicious email to break through that security infrastructure.

The industry forum that financial services organizations use to share data and critical cybersecurity threats within the financial services industry, the Financial Services Information Sharing and Analysis Center (FS-ISAC) experienced a successful phishing attack against its members when an employee clicked on an email and unwittingly gave up email credentials to a bad actor. The attachment was in PDF format with a link where credentials are harvested. From there, the credentials were used to send more malicious email to some members, affiliates, and other employees.

While FS-ISAC is in the midst of implementing a multi-factor solution for email, this particular person had not had it completed for email. What that would have prevented, ideally, is an email going out to others that looked like it came from that legitimate employee. With the MFA solution implemented, the messages would not have been sent without the second layer of security being completed, which the hacker would unlikely have had.

You see, phishers and all hacking types really do count on a level of trust between sender and recipient to be successful. If you see a message from a colleague, you are more likely trust that any links or attachments in it are safe. Unfortunately, this and many other examples show how this is no longer the case. It’s important now to be inquisitive about any information that comes in email, regardless of who sends it, before acting or providing confidential or sensitive information. This person could have prevented this by simply picking up the phone and calling a manager or the IT department to verify that it was necessary to enter login credentials into that site.

No customer data was accessed, according the FS-ISAC, but it’s clear that additional awareness training that is conducted on a continual basis cannot be discounted. Threats are always changing and it’s to any organization’s benefit to do this so that everyone who connects to the network will be aware and help prevent attacks.