How do the cybercriminals get us? There are many ways, but phishing remains at the very top of the list. The phisher thieves are very creative use various messages to trick us, both at the office and at home. Security researchers evaluated a list of topics and found that package deliveries, account updates, and human resource notices all made the list. However, the one at the very top might surprise you. That’s because it takes advantage of something that happens so often we are used to and frankly, we expect to see it.
Users clicked the following subjects
8% of the time:
- “Email Account Updates”
- “A Delivery Attempt was made”
- “Quick Company survey”
- “Revised Vacation & Sick Time Policy”
2
- “All Employees: Update your Healthcare Info”
- “Please Read Important from Human Resources”
- “Change of Password Required Immediately”
2
- “IT Reminder: Your Password Expires in Less Than 24 Hours”
- “UPS Label Delivery 1ZBE312TNY00015011”
2
- “Official Data Breach Notification” at 14%.
Ironic isn’t it?
The former chairman of the House Intelligence Committee told a group of attendees of the U. S. Chamber of Commerce’s cybersecurity summit recently about the impact phishing as on organizations. He noted that cybercriminals are creating such sophisticated email phishing attacks these days that it is nearly impossible to tell what is real and to defend against them. In fact, one recent attack using an Apple sign on notification was so realistic, that even the most eagle-eyed could not have recognized it as phishing just by looking at it.
Security professionals agree that tools alone won’t eliminate the risk. Therefore, it’s important to implement a comprehensive security and awareness training program for employees. Training and reviews should be done on a continual basis and include not only information on identifying phishing, but also a process for testing and retraining as needed.
There are many organizations that can help you do this. Some of them will help you create your own program, others will provide it for you, and others will combine the two approaches. When choosing a vendor, be sure to do thorough research, get recommendations from peers, and if you decide to outsource it, ask about how they secure their servers and systems. As we have heard about numerous times, third parties provide additional risk to your organization when they store your or your customers’ or members’ information.
There are software and hardware tools that can help, and they certainly should be implemented. However, they can only provide so much protection. All it takes is for one employee to click a link or open an attachment to set loose malware on your company’s network. With a good awareness training program, you can lower that risk considerably.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
