Phishing is nothing new–it’s been around since the mid-1990’s, and as attackers continue to successfully use this tactic, it’s not going anywhere anytime soon. So, what is phishing and why should companies across every industry take preventive measures to protect themselves against phishing? In this article, we’ll discuss what this type of attack is and the best practices to use in defending against phishing in 2023.
Phishing is a type of cyber attack that uses a form of communication, typically email, to trick recipients into taking an action that compromises their system by pretending to be a trustworthy source. Phishing attacks are usually carried out with the goal of acquiring sensitive information such as usernames, passwords, credit card information, or personal data.
Since phishing can serve so many purposes depending upon the attackers’ intentions, the consequences can be something as small as retrieving one person’s data for financial gain, selling initial access to other threat actors, or gathering sensitive data to later be used for malicious purposes. Either way, this type of cyber attack can target and affect anyone at any level in an organization, so it’s important that everyone is trained on phishing techniques and best practices when dealing with phishing attempts.
Let’s look at the ramifications of a successful attack. Depending on the scenario and attackers’ demands, an organization stands to lose their positive reputation and even corporate funds by falling for a phishing scam. When employee or customer information is exposed or vital files get held for ransom, it doesn’t take long for word to spread of your poor security practices and protocols.
This first of our phishing attacks is done by sending emails to people in an organization disguised as a legitimate document sharing company, like Box, Google Drive, or Dropbox. The emails sent often notify the recipient that someone has shared a file with them; since the rise of document sharing services, this attack tactic has grown in popularity over the past decade.
In spear phishing, certain people in an organization are targeted as opposed to entire departments or large groups of people; this way the communication style can be customized to sound more authentic. This type of attack is typically the first step attackers use to penetrate a company’s system before carrying out a more targeted, costly attack. According to the SANS Institute, 95% of attacks on enterprise networks use spear phishing.
BEC phishing emails are simple in that they are done by impersonating a company’s vendors or suppliers. Attackers that use this take time to research a company and get to know who their suppliers are before coming up with a phishing strategy to target unsuspecting employees.
Phishing attacks that target “big fish” individuals in an organization, like a CEO, are known as whaling attacks. This kind of attack usually comes after the attackers have dedicated time profiling their target, carefully planning the best time to steal log-in credentials from their big fish. Whaling is a vital type of attack to plan for because these high-level targets can access a large amount of sensitive information and can result in widespread damage when the attack is successful.
Our last type of attack is one of the most common methods used by scammers in phishing attacks. Mass mail phishing is a large-scale attack in that the same email format is sent to a vast amount of people in an organization with the hope that one of their attacks will “get a catch.” Typically, these emails will ask the recipient to share log-in credentials or click a link that will install malware.
Most phishing emails use similar tactics, making it easy to train employees on recognizing, including:
It’s impossible to defend against phishing attacks through technical means alone, so implementing a structured employee training program is often the first step your organization can take to protect yourself and your data. Teaching staff of every level on how to recognize phishing at regular intervals compliments the use of spam filters and monitoring systems.
When your needs warrant a more robust cybersecurity system, it’s time to consider managed security services. In this, a third-party organization, like Omega, can assist you in training employees to be more aware of and decrease the successfulness of phishing attacks. Contact the Omega team to get started with our managed security services and improve your security posture today.
