It’s everywhere you turn. Advertisements for security awareness training. The last line of defense. The human firewall.
There’s nothing wrong with training your employees to recognize security exploits. We recommend it. But it should be one part of a holistic defense-in-depth approach to security. Why is that? Because the math of having employee awareness training be your only line of defense is frightening. How frightening?
Phishing scams are more common than you might think. In fact, a person receives an average of six malicious emails per day, threatening the security of their computer and their systems.
Between 2013 and 2016, American businesses faced a staggering $500 billion in losses due to phishing scams. This led to an extensive FBI investigation of over 22,000 reported phishing scams.
What is a lateral phishing attack? A lateral phishing attack occurs when “one or more compromised employee accounts in an organization are used to target other employees in the same organization. Lateral phishing is similar to business email compromise (BEC), but while the latter is usually about getting victims to carry out fraudulent wire transfers, the main goal of the former is usually credential theft.” I suppose it means the attack occurs laterally across the org chart.
Been called to jury duty lately? Even if you haven’t, you might still get phished. Last week, in Ventura County, CA, a phishing scam was going around telling people that they missed their jury duty appointment.
According to the Citizens Journal, “In the calls and emails, recipients are pressured to provide confidential information, potentially leading to identity theft and fraud. These calls and emails, which threaten recipients with fines and jail time if they do not comply are fraudulent and are not connected with the Camarillo Police Department or the Ventura County Sheriff’s Office.”
Email forwarding is so common place, most people don’t give it another thought. But, as I pointed out in a recent post, email forwarding isn’t always smart to do.
In that post, I point out a handful of reasons why blindly forwarding emails can get you into a little hot water. First, there are the copyright issues. When someone writes an email, it is by definition, copyrighted. Depending on who you are forwarding it to, where and how often, you could be in violation of copyright law.
If you follow the news at all, you know that phishing attacks, cyber breaches and ransomware are everywhere. It’s practically an epidemic. But, not all victims are created equal.
It’s one thing if a bank or a big corporation or even a government entity gets hit with a cyber-attack. They either have, or can find the resources to recover from such an event. Many even have some form of insurance to bail them out. But lately, hackers have pulled out all the stops and have started targeting some of the most vulnerable in society.
If it’s making headlines, you can be sure it’ll be used in a phishing scam. What’s the big news this week? Jeffrey Epstein suicide in jail. Queue the phishing emails.
According to KnowBe4, “a series of scams are underway using the Epstein death as social engineering tactic.” Maybe something to the effect of “See Jeffrey Epstein Last Words on Video.” Admittedly it’s hard not to click on that, but don’t.
Phishing is so widespread today, you can feel the effects of a phishing attack even if you’re not the one who got phished. The latest example of this is detailed in a report on Bleeping Computer: “Phishing Attacks Target US Utilities with Remote Access Trojan.”
About a year ago, information security company Shred-it released a report saying “Employee negligence is the main cause of data breaches.” I have no doubt that’s true. The part I disagree with is the solution.
The solution that’s being promoted for the “employee” problem is phishing awareness training. And not just training, but MORE training. There’s only one problem with this way of thinking: it won’t eliminate data breaches.
We’re always impressed when fraudsters come up with new and clever ways to execute phishing scams and this week didn’t disappoint us. This week we get word of a phishing scam disguised as fake e-tickets for Korean Airlines.
According to the article, “South Korean flag carrier Korean Air (KE) has warned customers against phishing scams using fake e-tickets. Seungwon Chung, KE Global Communications deputy general manager, confirmed with the Philippine News Agency (PNA) on Monday that the carrier has received [a] few complaints regarding this recently.”