Make sure your staff don't fall for phishing scams
Five basic e-mail safety rules
Many successful hacks still start with phishing scams
Phishing certainly isn't a new threat. But it is an urgent one. Over the years, cyber-crooks have professionalised their activities, making it increasingly easy for them to mount large-scale attacks. Their tactics are more and more cunning too, so that even experts can find it hard to spot the scams. Several recent studies, including one by Verizon, have highlighted how successful hacks usually start with phishing. Consequently, phishing remains a bigger problem than ever, despite the growing availability of anti-phishing solutions. So what's behind that startling observation?
Raising awareness
Many businesses struggle with the technical aspects of cybersecurity, and security experts are scarce and expensive. Against that background, it's easy to see why so many organisations still find it hard to achieve a basic level of security. Awareness training is different, though. It's a solution that everyone can understand, but is extremely effective and cost-efficient. Most organisations can easily make themselves more resilient by giving their staff regular awareness training.
Why is anti-phishing training so important? Check out the facts and figures!
Attack frequency differs from one industry to the next. However, 88 per cent of organisations worldwide reported getting phishing mail in 2019 (DBIR, Verizon), and in 55 per cent of cases, the attacks succeeded. The situation is particularly bad in the United States, where 65 per cent of phishing scams worked.
For the vast majority of phishers (96 per cent), e-mail is the chosen medium. However, malicious websites are sometimes used as well (3 per cent) and occasionally scammers make contact by phone.
Clearly, therefore, it's vital to draw everyone's attention to the threat posed by phishing, especially e-mail based phishing, and to keep reminding them.
Five basic rules you can share with your staff tomorrow:
Be especially cautious about messages that appeal to the emotions. Words such as urgent, priority, attention, request, important, payment and required should be treated as 'red flags'.
Got a feeling something might be fishy? Check the sender's e-mail address before clicking any links or passing on information. That's extra important if the sender is a trusted brand, a prominent individual and/or a manager. To check an address, simply hover on the sender's name – position your mouse pointer on the name without clicking.
Check where links in e-mails actually lead. The text in a link doesn't always match the URL that it points to. To reveal the URL, hover over the link. Not sure about a link? Don't click it!
Before entering data on a website, make sure that the site's address matches the organisation you think you're dealing with. Also, check that the site's secure by looking for the padlock symbol in your browser's address bar.
Finally, remember: reputable brands and professionals won't ever ask you to share sensitive, personal information. If you do get asked for info, contact the company or individual in question via another channel to make sure the request is genuine.
Any employer who keeps reminding their staff about those five rules is well on their way to increased cyber-resilience. Repetition is vital, because it's normal for people to gradually get more relaxed about a threat. Hackers know that and try to strike just when they think people might have lowered their guard. So they'll pick up on current events, by for instance sending messages about the coronavirus pandemic or trending conspiracy theories.
Do regular phishing tests
A phishing simulation works best if no one, including you, knows exactly what to expect and when. So it makes sense to leave testing to an external service provider. That way, you know the tests will be frequent enough, and you'll get proper reports telling you and your staff how well prepared you are. Also, it's no bad thing to include a play element if that helps to raise awareness of the phishing threat.
