While phishing attacks have been around for years, recent research indicates their success rates are on the rise, as attackers launch more sophisticated campaigns. Security experts point to the growing importance of social media education in fighting this threat, particularly in the financial sector, which tends to be highly targeted.
In past years, phishing campaigns have had success rates between 10 and 20 percent, according to Verizon, which publishes an annual Data Breach Investigations Report. The 2015 report, however, showed that last year attackers’ success rates rose, with 23 percent of recipients opening phishing emails and 11 percent clicking on embedded attachments. Financial gain remains a key motive for attackers.
“Even though this is a well-recognized, known technique, attackers have gotten very good at crafting emails,” said Colin McKinty, vice president of cyber strategy for the America with BAE Systems Applied Intelligence. “They are leveraging their reconnaissance. They are going in social media and looking at the inadvertent leakage of information to craft email, so that when it arrives in an inbox it looks very genuine. To be honest you can’t blame someone for clicking on it.”
While technological detection tools remain important, employee education is increasingly seen as a key component of fighting phishing attacks, with social media awareness becoming an essential part of that education.
McKinty said firms need a comprehensive social media assessment to evaluate what type of information is available on social media and how that information might expose a firm to risks of attack. Information that can make firms susceptible can be as mundane as personal information about employees’ interest and hobbies.
“If I am into soccer and I post something about my interest in a particular team, an attacker can use that information to send me information on my team that might make me more likely to click on the email if I’m not thinking,” McKinty said.
With the difficulty of discerning highly targeted phishing emails, employees should also be prepped in ways to spot potential phishing attacks, including practice reviewing emails from unknown sources for signs of phishing, such as spelling errors, queries that seem out of context with a recipient’s job function and risky content like links or attachments.
McKinty said BAE Systems Applied Intelligence stages practices with client firms, where employees are sent emails with the markings of a phishing attack to measure their likelihood of opening them.
After educating employees, firms are advised to set up processes for handling suspicious emails as well.
“We ask organizations to set up some sort of phishing email address – an address of a support team they can send suspicious email to, that can report back to them to say whether this is actually a phishing email.”
Meanwhile, while training is an important tool to reduce phishing success rates, it is just one component of fighting phishing. Firms should have tools in place such as behavioral analysis of networks and systems to detect and mitigate threats once they have entered the network.
“You have the right tools in place, the right processes in place and you train people, but because people are ultimately involved in this, the chances are an attacker who does enough reconnaissance will find someone who will click on this email,” McKinty said. “You need security measures in place to detect when a breach has occurred and detect and remediate that breach before too much damage is done.”
Related Articles:
Financial firms trail other industries in cyber threat remediation, study shows
JPMorgan will double cybersecurity spending but many other companies may cut costs
Overstock opens debate on how a Bitcoin securities exchange might function