July 14, 2020
Homefield IT
IT Consulting & StrategySecurityConstructionEducationFinanceHealthcareLegalReal Estate
Phishing is when a hacker uses fraudulent communications to manipulate a member of your organization into handing over privileged access to your network infrastructure. For nearly two decades, phishing has been the most popular and effective tool in the hacker’s arsenal, helping them steal data, install malware onto servers and PCs, and execute successful ransomware attacks.
While phishing methods continue to change and evolve, they all share one thing in common: a lapse in personal judgment. While we can install tools to help protect a company against these attacks, if their staff continues to fall for phishing headlines, click on suspicious links, or open malicious email attachments, then those tools will only have a limited impact.
The only way to achieve a high level of readiness is with regular employee security awareness training that’s customized to the needs of your organization, like the kind offered by Manhattan Tech Support and its dedicated cybersecurity division, Kaytuso.
The Anatomy of a Phishing Attack
Phishing has its roots in the early days of the modern Internet when hackers used fake messages to obtain free accounts on services like American Online and CompuServe. Since then, it’s evolved into a sophisticated form of social engineering with many unique variations.
By far, the most common method of phishing attack delivery is using fraudulent emails. An estimated one trillion phishing emails are being sent every year, which vary in quality from the generic and immediately noticeable, to highly sophisticated and stealthy attacks.
Rudimentary phishing emails are generally easy to spot. Some common indicators of a phishing email include:
- Misspelled names and headlines
- Email copy that reads like non-native English speakers wrote it
- “Official” company emails that have awkward or unprofessional templating
While email is the most common way to deliver a phishing attack, in recent years, hackers have begun to embrace SMS, voicemail, and social media to send phishing attacks.
Website Spoofing – Another Common Tool in the Phisher’s Toolbox
In addition to email, another common form of phishing attack is the domain spoof. This scam uses a fraudulent domain and website to impersonate a business. These fake websites have the visual branding of the company’s legitimate site, sometimes down to the smallest details. Like a phishing email, the goal of a spoofed site is to trick a user into handing over sensitive or valuable information.
Some of the prominent red flags for spotting and handling a spoofed website include:
- Inspect URLs for subtle misspellings or incongruities
- Beware of prominently displayed toll–free numbers and urgent calls to action
- Copy and paste suspicious URLs into a text editing program for better inspection
- Navigate away from any site that forcefully requests you download a file
Fact: According to the Thales Access Management Index, spoofing attacks have more than doubled over the last 12 months, costing U.S. businesses over $1.3 billion.
The Threat of Next-Generation Phishing Attacks
In recent years, skilled hackers have started embracing new phishing methods that go far beyond just generic emails and spoofed websites. It’s common for a hacker to spend hours or more developing targeted phishing emails that are built to defraud a single group or person. These attacks are much harder to identify than a standard phishing email, and much more successful.
There are many targeted phishing attacks your staff must learn to defend themselves against:
- Spear-Phishing
In a spear-phishing attack, hackers carefully craft a message to target a specific individual, often impersonating one of their trusted co-workers or associates. The attacks are designed to steal login credentials, financial data, and other information by creating the most authentic fraudulent communication possible. - CEO Fraud
This popular type of attack goes by several different names, like business email compromise (BEC), but it’s essentially the same in all scenarios. Someone creates an authentic-looking communication from the leadership of a company. This person then directs a subordinate to take action, like paying an invoice or sending important information to a third party.
Even in normal times, the threat of phishing attacks is enormous. Since the COVID-19 epidemic, hackers have been resourceful about exploiting this new source of uncertainty and fear. According to Google, phishing attacks have increased by 350% since the coronavirus quarantine began.
Regular, High-Quality Training is the Best Protection Against Phishing Attacks
There are plenty of generic cybersecurity training courses out there that can guide you through the remedial steps of securing your business against phishing attacks. Still, those sessions are often not enough to achieve optimal protection.
Instead, businesses should look to providers like Manhattan Tech Support and its dedicated cybersecurity division, Kaytuso, who provide fully customized training sessions for not just each industry and regulatory compliance need, but also for each staff member and role within your company.
Executives and Management Positions
Senior executives sometimes feel that their intelligence and success insulate them from cyber threats when the reality is that it makes them the primary target of the most sophisticated phishing attacks. We can design a training course that not only prepares them for the most advanced threats but also fits into their busy schedules.
IT Staff and Departments
Technical staff should be offered the latest, most detailed information possible so that they can translate that intelligence into top-quality cyber defenses. Kaytuso provides a combination of in-depth education and training in the latest practical aspects of cybersecurity that will help ensure your IT staff is ready to take a strong leadership role in your organization.
Research from cybersecurity firm KnowBe4 found that nearly 38% of users who don’t undergo cyber awareness training fail phishing tests.
High-Quality Phishing and Cybersecurity Training from Kaytuso
Regular, high-quality cybersecurity awareness training can transform your staff from a liability into your greatest cybersecurity asset. As a veteran of the managed cybersecurity and security training field in New York, Manhattan Tech Support has armed countless businesses with the latest threat intelligence and best-in-class IT security solutions. We look forward to helping more companies realize the power of high-quality cybersecurity awareness training.
If you want your staff to become a strong frontline defense against cyberattacks, we encourage you to reach out and learn more. Our friendly, responsive team is eager to help! Call us any time at [sales-phone] or email us at [email-address].
