Study Finds People Don't Hesitate to Click When Email Comes from Known Senders

Thirty-seven percent (37%) of social media users don't bother to do research or check the identities of the people with which they connect on sites such as LinkedIn or Facebook. That is quite alarming. Especially since, per security firm Avecto, 90% of cyberattacks and the subsequent related data breaches are typically a consequence of spear phishing.

Spear phishing is when an attacker specifically targets someone within an organization and/or pretends to be someone in that or another organization with intent to convince an otherwise trusting person into giving up sensitive or confidential information. They often find what they need to start the scam by perusing social media. LinkedIn, for example, contains a wealth of information about the users. It often has not only the name of the users’ employers, but also their job titles and duties. Many times, even their managers' names and vendors with which they do business can be found in their profiles. This leaves the door wide open for a cybercriminal to perform spear phishing scams; and rather easily.

Spear phishing is a growing trend and has successfully worked for cyberthieves in getting money transferred to their accounts, W-2 and payroll information sent to them, and helped them acquire enough information to cost companies over $3.1billion in business email compromise (BEC) and whaling scams (per the FBI). It isn't going away any time soon. That’s because it works very well.

Avecto contacted 1000 daily internet users and found that while 65% were suspicious of clicking links sent in email by unknown senders, a whopping 68% had no concerns about doing the same when the message supposedly came from a colleague, friend, or vendor/supplier. This is frightening since it is very easy to send an email that appears to be from one person, but is in fact from another.

Once a cybercriminal has the information, it doesn't take long for him or her to devise a creative scheme preying on the curiosity and trust of humans. It has worked on Seagate, Ubiquiti Networks, Sony, and many others. Humans will always be the organization’s weakest link, because we are a curious and trusting lot. Good qualities to have in a civilization, but they can also be used to persuade us to do things that we may not do otherwise, or we may not do if we had proper training on cybersecurity.

Having a training and awareness program in place is an important step in protecting your company's information. Include information on how to identify a potential phishing attack, how to avoid falling prey to them, and what to do in case of accidental click. Once these have been stressed to everyone that connects to the network, do some testing to make sure it is thoroughly understood. After all, what good is providing the information if you never follow up to find out if it’s actually working?

Proofpoint performed a study in 2016 and found that 80% of the participants had experienced some form of BEC in the 30-day period prior to the study. So while implementing cybersecurity technology solutions is recommended, training and awareness is just as important.