Sophisticated Tools Can Help Detect Phishing; Most Who Use Them Just Don't Configure Them To

Just like email, phishing attacks are a part of life these days. Unfortunately, it’s very difficult to detect and filter out suspicious email messages, even with sophisticated tools implemented into a corporate network. The company GreatHorn ran some numbers in it's 2017 Spear Phishing Report to determine what companies are doing to try to thwart these attacks. It found that while most of those surveyed did do some type of filtering, a lot of them didn’t use all, or even many of the features in the anti-phishing software used that could help them out.

The most used function was to alert an administrator when a suspicious message was detected. One third of them used this to give the administrator an opportunity to review it before sending it on the recipient.

Six percent (6%) of systems were configured to send an alert to the message’s recipient when something was deemed potentially dangerous and 2% were sent directly to the trash. Another 1% was quarantined for further review and 7% were filtered into a separate folder for analysis.

What was probably most shocking was that 41% of the time, no action at all was taken other than for the messages to be monitored. This leaves it up to the recipients to determine if email messages are phishing or real.

Unfortunately, that is also a difficult task. Spearphishing attacks, such as business email compromise (BEC) are on the rise with small companies, schools, and healthcare organizations sitting right in the crosshairs of the attackers. The average worker receives between 50 and 150 email messages per day. It’s not difficult to see how overwhelming trying to determine if one is phishing can be.

How are the attackers tricking us? GreatHorn looked at 500,000 spearphishing attempts. Of those, an astonishing 490,557 had the display name changed to appear as if the sender was someone known to the recipient. However, there were also other indicators of a fake message such as suspicious URLs in attached links and unmatched domain names used in the email addresses.

In addition, 45,000 were received with spoofed reply addresses or other fields that made the messages appear as if they were internal to the organization. A small amount (2,334) used domain names that were fake, but looked very similar to the real organizations’.

Besides implementing tools and configuring DMARC (which is somewhat complex to do), having a training program in place is the best defense. No matter what is done using technology, the phishers will always find ways around. Therefore, investment in education is worthwhile. In 2015, the Ponemon Institute released a study that found companies that implemented training programs saw improvements of between 26 and 99 percent in their phishing email click rates. That results in a savings of $395 per employee that otherwise would be spent dealing with a successful phishing attack.