Why Your Employees Keep Clicking on Phishing Emails, and How You Can Stop It

The 2017 Verizon Data Breach Report is out, and it’s full of great news – if you’re a hacker. The study, which examined over 1,900 breaches and more than 42,000 attempts in 84 countries, showed that cyberespionage and ransomware are on the rise. The manufacturing industry is particularly vulnerable to having intellectual property and company secrets stolen by cyber spies. How do these spies and garden-variety hackers get into enterprise systems? Quite often, the Verizon report found, it all starts with a social engineering attack, most commonly a phishing email.

“Business Email Compromise” Scams Costing Firms Billions of Dollars

Verizon found that social engineering methods were used in 43% of reported breaches, and of those, 93% were in the form of a phishing email. Once hackers have successfully phished their way into an organization’s network, the next step is usually (95% of the time) to install malware.

Not long after the Verizon DBIR hit the virtual stands, the FBI came out with its own damning statistics regarding a phishing variant known as a “business email compromise” (BEC). In a BEC scam, hackers get hold of the login credentials for an email account belonging to a high-ranking company executive – once again, this is usually accomplished through phishing – and use it to send what appear to be legitimate emails requesting that employees or vendors make wire transfer payments. BEC scams, the FBI reported, saw an astounding 2,370% spike in “exposed losses” over a two-year period ending December 2016, totaling $5 billion.

Keep in mind that this $5 billion figure doesn’t count losses from other types of phishing emails, such as email spoofing or the compromise of personal email accounts. The brazen Google Docs phishing scam that ensnared approximately one million victims last week cost the state of Minnesota alone an estimated $90,000, as state employees scrambled to deal with the attack instead of doing their jobs.

The Hacks Will Continue Until Proactive Cyber Security is Prioritized

Why do employees keep clicking on phishing emails? In most cases, it’s because they don’t know any better. Despite living in an increasingly connected world, the majority of Americans have little or no understanding of cyber security best practices, especially how to identify phishing emails. They aren’t learning about cyber security best practices on their own time, and their employers aren’t teaching them, either. Companies are handing their employees login credentials, maybe installing a firewall and anti-virus package, and hoping for the best.

While technical controls such as anti-spam filters, network segmentation, and avoiding private email servers unless your organization has the in-house staff and expertise to manage them are important, the best way to protect an organization against phishing is to address the human factor and teach employees about cyber safety. Some points to remember:

• All employees must be trained on cyber security best practices, not just certain groups. Too often, enterprises will comprehensively train their IT staff and other upper-level staff members, only to have a receptionist or an intern get phished. White-collar workplaces need to take cyber safety as seriously as blue-collar environments take physical safety; anyone in the organization who touches a computer for any reason needs to know how to operate it safely, including part-time workers, temps, and interns.
• Cyber awareness training requires continuous education. The threat environment changes daily, and employees must be kept up-to-date on the latest dangers and how to avoid them.
• Penetration testing is an important part of training. By sending fake phishing emails to employees and seeing who clicks on them, enterprises will know where their weak spots are, and employees who fall victim to the fakes will learn from the experience.
• Companies must have a specific procedure for reporting suspicious emails. If an employee receives an email that looks suspicious, they should know exactly who they are to alert and how. Employees must feel comfortable reporting any activity that doesn’t look quite right so that security personnel can investigate further.

There is no such thing as an organization that is “too small” or “unimportant” to be hacked. Some small organizations think they cannot afford proactive cyber security, but can they afford to lose tens, even hundreds of thousands of dollars to a breach? Securing your enterprise systems is just as important as locking your building’s doors at night; you cannot afford not to protect your network. Until everyone realizes this, the hacks will continue, and the losses will keep mounting.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance with all applicable laws, frameworks, and standards.

[bpscheduler_booking_form]