From tighter regulations for public sector to ransomware and the continued rise of the remote workforce, read all about it from our senior management team as they weigh in on their thoughts for 2022.
Looking at 2022, and it seems clear that there will be tighter regulatory oversight for the public sector.
Steve Nicholls, Commercial Director
The NHS is already going through Data Security Privacy Toolkit (DSPT) processes and several recent tenders for large public sector organisations have made compliance to Cyber Essentials Plus a mandatory requirement for every supplier. If the NHS is a template, then more public sector organisations will be required to adhere to CE+ within a few years. And I would expect these requirements to spread to anybody that supplies into the public sector. The framework is not onerous, but it is audited which means that organisations need to do more than just a “check box” exercise so it’s wise to start looking at these optional processes now and before they become mandatory.
Although Ransomware is certainly not new, the last year has seen its meteoric rise in the public consciousness and the coming year will unfortunately be more of the same.
Malcolm Orekoya, Chief Technology Officer
However, the move by AXA, one of Europe’s largest insurers, to stop offering new insurance policies that cover ransom payments to criminals for French policy holders may be the start of a wider trend across the region during 2022. The logic is that ransom payments encourage more ransomware attacks and drive up the cost of cyber security insurance policies. Although UK companies can still gain insurance policies that will pay ransoms – assuming you can prove no liability, it’s likely that AXA’s position might spread. The whole market for insuring against all forms of cyber-attack and outage is an interesting area and I suspect that 2022 will be a year where its starts to get a lot more attention from enterprises.
The ‘great return to the office’ has not materialised as expected by most, with more organisations opting to have more staff working remotely as a permanent option.
David Bundock, Chief Operations Officer
The first of the studies that have looked at issues such as productivity and mental wellbeing are starting to emerge and, in many instances, home working seems to be on parity with office working and, in some cases, proving a benefit. However, organisations must now look at the often-temporary measures rushed out to support home workers that are now becoming standard. Where masses of laptops were hurriedly deployed, and cloud based filesharing systems were utilised to help teams collaborate – these devices and platforms need to be audited for security and compliance to standards such as GDPR. This will inevitably trigger more use of cyber security as a service – especially as the current shortage of skilled IT and Infosec staff grows.
Knowing where to start with your organisations cyber security can be confusing. Have you considered a dedicated cyber security platform to help reduce the risk of a cyber incident?
A combination of bad employee behaviour and dark web data spells trouble for businesses! From SMBs to giant multinationals, it doesn’t matter how high-flying a company is, unfortunately password problems will still plague them.
The struggle to get users to make good, strong, unique passwords and keep them secret is real for all organisations and IT professionals. It can be hard to demonstrate to users just how dangerous their bad password can be to the entire company, even though an estimated 60% of data breaches involved the improper use of credentials in 2020. There’s no rhyme or reason to why employees create and handle passwords unsafely, no profile that IT teams can quickly look at to determine that someone might be an accidental credential compromise risk. Employees of every stripe are unfortunately drawn to making awful passwords and playing fast and loose with them – and that weakness doesn’t look like it’s going away anytime soon.
Everyone is managing too many passwords
The average adult has an estimated 100 passwords floating around that they’re using. That’s a bewildering tangle of passwords to manage. The global pandemic helped put even more passwords into circulation as people either working from home or on furlough created an abundance of new online accounts. According to the conclusions of a global study conducted by Morning Consult for IBM, people worldwide created an average of 15 new online accounts, per person, during the main thrust of the pandemic.
Many of those logins were compromised from the start thanks to abundant dark web data. An estimated 15 billion unique logins are circulating on the dark web right now. In 2020 alone, security professionals had to contend with a 429% increase in the number of corporate login details with plaintext passwords exposed on the dark web. That dramatic increase in risk per user comes back to haunt businesses. The average organisation is now likely to have about 17 sets of login details available on the dark web for malicious actors to enjoy. That number is only going to continue to grow thanks to events like this year’s giant influx of fresh passwords from the RockYou 2021 leak.
Employees are dedicated to making bad passwords
Research by the UK’s National Cyber Security Centre (NCSC) shows that employees will choose memorability over security when making a password every time. Their analysts found that 15% of people have used their pet’s name as their password at some point, 14% have used the name of a family member,13% have used a significant date, such as a birthday or anniversary and another 6% have used information about their favourite sports team as their password. That makes the criminals jobs easy even if they’re trying to directly crack a single password. After all, those users have probably told them everything that they’d need to know to do the job in their social media profiles.
US companies aren’t any better off. In fact, their bad password problems are just a little bit worse. 59% of Americans use a person’s name or family birthday in their passwords, 33% include a pet’s name and 22% use their own name. We can’t chalk that blizzard of bad passwords up to ignorance of good password habits, because even employees who know better are slacking on password safety. Over 90% of participants in a password habits survey understood the risk of poor password hygiene, but 59% admitted to still engaging in unsafe password behaviours at work anyway.
Password sharing is rampant
Worse yet, employees are also sharing their passwords with other people at an alarming rate, even if the people they’re sharing a password with don’t work at the same company. Over 30% of respondents in a Microsoft study admitted that their organisation had experienced a cyber security incident as a result of compromised user credentials that had been shared with people outside their companies.
43% of survey respondents have shared their password with someone in their home
22% of employees surveyed have shared their email password for a streaming site
17% of employees surveyed have shared their email password for a social media platform
17% of employees surveyed have shared their email password for an online shopping account
Based on analysis of the top 250 passwords found through the application of Dark Web ID’s dark web search function that uncovers exposed credentials, these categories of information were used to generate the weakest passwords in 2020 which were: Names, Sports, Food, Places, Animals and Famous People/Characters.
The most common passwords spotted by Dark Web ID by category
Every organisation in every industry is in password trouble
No industry is immune to the powerful lure of terrible password habits, especially that perpetual favourite password recycling and iteration. In a study of password proclivities, researchers determined that some sectors did have a little more trouble with passwords than others though. The telecommunications sector had the highest average number of leaked employee credentials at 552,601 per company. The media industry had the highest password reuse rates at 85%, followed by household products (82%), hotels, restaurants & leisure (80%), and healthcare (79%).
A trove of exposed data about Fortune 1000 companies on the dark web was uncovered by researchers earlier this year, including passwords for 25.9 million Fortune 1000 corporate user accounts. Digging deeper, they also unearthed an estimated 543 million employee credentials from Fortune 1000 companies circulating on commonly used underground hacking forums, a 29% increase from 2020. Altogether, they were able to determine that 25,927,476 passwords that belong to employees at Fortune 1000 companies are hanging out on the dark web. That’s an estimated 25,927 exposed passwords per Fortune 1000 company, marking a 12% increase in password leaks from 2020.
Busted credentials are plentiful on the dark web
If data is a currency on the dark web, then credentials are solid gold. Credentials were the top type of information stolen in data breaches worldwide in 2020, (personal information took second place just over financial data in third), and bad actors didn’t hesitate to grab batches of credentials from all over the world. Cyber criminals snatched them up in about 60% of North American breaches, 90% of APAC region breaches and 70% of EMEA breaches. Researchers disclosed that the average company experiences 5.3 credential compromises that originate from a common source like phishing every year, a number that should give every IT professional chills.
An abundance of records on the dark web has spawned an abundance of passwords for cyber criminals to harvest, and that’s bad news. Giant password dumps on the dark web like the 100GB text file dubbed RockYou2021 have ratcheted up risk too. That giant dump of data is estimated to contain 8.4 billion passwords. Bad actors make use of that bounty quickly and effectively.
In the aftermath an enormous 2020 hack, ShinyHunters breached the security of ten companies in the Asian region and brought more than 73 million user records to market on the dark web. A group like ShinyHunters will of course try to profit by selling that stolen data at first, but when the data has aged or there are no interested buyers, cyber criminals will just offload it in the vast data dumps of the dark web making it available for anyone to sift through.
Protect your business from password danger quickly & affordably
With our support we can discover if any of your employee’s reused passwords have been exposed on the dark web so that you can change them right away.
What next?
By utilising our certified dark web monitoring tool we’ll perform a non-invasive scan of your company’s domain and produce a pdf report that will highlight any compromised credentials.
Last week I read this blog titled 3 Big Facts About Cybersecurity In 2020 To Remember For 2021 which talks about phishing, ransomware and The Dark Web. Whilst I agree with these 3 threats, it’s important to remember that a layered security approach for any organisation is key to the sustainability of growth and development. Yes, last year saw a rise of the distributed workforce, the fast adoption to the cloud and a massive increase in COVID related scams, which are still being executed by cyber criminals, thus making your company and all your employees more susceptible and an easy target especially when security most certainly was not and is not top of mind.
For many the need for business continuity and getting up and running as soon as possible those few days before lockdown announcement number 1 massively outweighed concerns over networking and security. And why wouldn’t it! However now we face being in lockdown number 3, with no real idea of when we will be normal again or what normal might look like and still you’ve not addressed those ‘pesky’ security concerns.
So, following on from the blog mentioned above here are 3 key takeaways so you can start to take your cyber security back into your own hands. Remember cyber security is companywide and not just and IT issue.
1. Phishing Rules the Roost
Most of today’s nastiest threats have a common denominator: phishing. More than 80% of all cyber attacks are phishing based. That means that an essential part of keeping your business safe from cyber crime is keeping your business safe from phishing. Phishing attacks skyrocketed by over 600% in 2020, and that’s not going to go away.
How to mitigate the risk?
People are a critical layer within your cyber security posture and with greater reliance on email communication, the dangers of phishing are even more apparent for businesses, especially in the form of ransomware.
By committing your company to Security Awareness Training in this ever changing world will help protect against the growing and varying threats organisations face today. Don’t let those criminals leap to the golden opportunity that increased email usage creates for them to launch phishing attacks – and they’re branching out with more attempts through voice, text, messaging, and SMS.
2. Ransomware is Here to Stay
Ransomware was the most devastating and disruptive single threat type in 2020, and that looks set to keep going through 2021. More than 50% of businesses were impacted by ransomware in 2020. It’s become a favoured tool of hackers from sophisticated nation-state groups to cyber criminal gangs on The Dark Web. Experts estimate that a ransomware attack will take place every 11 seconds in 2021.
Cyber criminals aren’t just using ransomware to steal data anymore. In 2020 there’s been a trend towards ransomware being used to disrupt operations at businesses, manufacturers, essential services, infrastructure targets, and hospitals plus many organisations in other sectors worldwide. Just before the COVID-19 vaccine news started rolling in, cyber criminals were deploying ransomware against hospitals, pharmaceutical developers, laboratories, even cold storage trucking companies. They weren’t trying to steal data, they were trying to disrupt operations at critically needed organisations in order to score a big, quick payday, and they were successful in many cases.
How to mitigate the risk?
Don’t click links in emails
Scan emails for malware
Firewall and endpoint protection
Keep data backups, regular
Protect your information
3. Dark Web Danger is Real and Growing
The Dark Web is a complicated place, and just like everything else in the world, the chaotic nature of events in 2020 impacted the way it operates too. It hasn’t stopped growing – Dark Web activity has increased by more than 300% in the last 3 years. While it hasn’t been as much of a newsmaker as flashier things like nation-state hacking, make no mistake – it’s still an enormous threat to all businesses, and that threat is only growing larger with time.
The proliferation of information gathered in data breaches, especially in last year’s record-breaking year, provides ample fuel for cyber crime like credential stuffing and spear phishing. An article published on the 3rd February 2021 states more than 3 billion unique pairs of cleartext emails and passwords were leaked online from previous data leaks.
The growth of the cybercrime-as-a-service sector of the Dark Web economy also puts companies squarely in the crosshairs of bad actors. Plus, in a challenging economy, even cyber criminals are feeling the pinch and looking for new ways to rake in cash.
How to mitigate the risk?
Dark Web monitoring solutions are a security essential because it provides your company with something incredibly precious: time. By having your business credentials monitored 24/7/365 with our expert human and machine-powered analysis, you’re making it possible for you to find out if you’ve been a victim of credential compromise fast. Which gives your IT team time to address vulnerabilities before the bad guys even find them.
No Company Can Afford A Cyber Security Nightmare.
Let NetUtils help you add strong cyber security protection at a price that won’t keep you up at night. To get you started we’d like to offer you a complimentary Dark Web scan and we’ll show you how our solutions can help you secure yours and your clients’ systems and data against today’s (and tomorrow’s) biggest threats fast.
A recent report reveals a massive 667% increase in spear-phishing attacks due to the current pandemic, with over 9000 phishing attack campaigns, related to COVID-19, being detected in March versus just over 1100 in February and only 137 in January. These attacks are taking on all forms including; brand impersonation, business email compromise, scams and even blackmail. *
Organisations like yours have asked traditional office-based employees to work from home. The potential for cyber criminals to get your users to react to these types of spear-phishing attacks is high due to the coronavirus theme being exploited and all organisations need to ensure their users remain vigilant.
Is your newly formed remote workforce armed with the knowledge to keep themselves and your network safe? Watch our webinar below and learn:
About the tactics the bad guys are using now to exploit COVID-19
Why remote workers are an easy target for cyber criminals
How to enable your last line of defence with tools and training
Why security awareness training is critical within your security strategy
Now more than ever Security Awareness Training is vital for your remote employees and your network.
As cybercrime continues to surge, security leaders must understand that there is no such thing as a perfect, fool-proof, impenetrable secure environment. Many organisations fall into the trap of trying to use technology as the only means of defending their networks and forgetting that the power of human awareness and intervention is paramount in arriving to a highly secured state.
Every security leader faces the same conundrum: even as they increase their investment in sophisticated security orchestration, cybercrime continues to rise. Security is often presented as a race between effective technologies and clever attack methodologies. Yet there’s an overlooked layer that can radically reduce an organisation’s vulnerability: security awareness training and frequent simulated social engineering testing.
Verizon’s 2019 data breach investigation report shows that phishing remains the #1 threat action used in successful breaches linked to social engineering and malware attacks.
These criminals successfully evade an organisation’s security controls by using clever phishing and social engineering tactics that often rely on employee naivety. Emails, phone calls and other outreach methods are designed to persuade staff to take steps that provide criminals with access to company data and funds.
Each organisation’s employee susceptibility to these phishing attacks is known as their Phish-Prone™ percentage (PPP). By translating phishing risk into measurable terms, leaders can quantify their breach likelihood and adopt training that reduces their human attack surface.
Do you know how your organisation compares to your peers of similar size? Download the KnowBe4 benchmarking report to find out!
You will learn more about:
New phishing benchmark data for 19 industries
Understanding who’s at risk and what you can do about it
Actionable tips to create your “human firewall”
The value of new-school security awareness training
A new report reveals a massive 667% increase in spear-phishing attacks due to the current pandemic, with over 9000 phishing attack campaigns, related to COVID-19, being detected in March versus just over 1100 in February and only 137 in January. These attacks are taking on all forms including; brand impersonation, business email compromise, scams and even blackmail. *
Many organisations like yours have asked traditional office-based employees to work from home and while technology allows that to happen, is your newly formed remote workforce armed with the knowledge to keep themselves and your network safe?
The potential for cyber criminals to get access to your users and to elicit a response to these types of spear-phishing attacks is high due to the coronavirus theme being exploited and all organisations need to ensure their users remain vigilant.
Cyber-attacks focus on employees as targets – Phishing attacks remain the single-most used attack vector to allow the bad guys direct access to your organisation’s endpoints, credentials, applications, and data. If a phishing email is presented to one of your employees, it means your security solutions haven’t detected it as malicious, leaving the employee to be your last line of defence.
Employee’s aren’t thinking about organizational security – Think about it; your average remote worker is sitting at a make-shift desk, trying to balance helping their kids with distance learning assignments and attending online meetings. They’re learning new digital workplace platforms, applications, and processes before they even shower for the day. Security is the last thing on an employee’s mind.
Attacks and scams are increasingly aligning with remote working – Cybercriminals conjure up scams that seem familiar to users. The use of shipping, billing, and banking stories, as well as the use of impersonated domains, business, and people, all have traditionally worked in favour of the bad guy. But, new scams are being moulded around the current work circumstances. For example, we’ve recently seen the massive growth in Zoom-related attacks simply because of Zoom’s increase in popularity for business use. Organisations should expect this to trend.
Did you know that 77% of successful social engineering attacks start with a phishing email?
Social engineering attacks include phishing, spear phishing, CEO fraud, ransomware and more. Learn about different attack methods and how you can manage this ongoing problem in your organisation.
Watch our webinar on-demand to discover:
Common techniques used by hackers
Real world examples
Social engineering red flags
How to prevent attacks
There’s no substitute for preparation when it comes to dealing with cybercriminals, take the steps needed to future proof your organisation against these types of attacks.
Social engineering tip sheet
The below infographic will show your users what to watch out for in emails. We highly recommend you print it out, it’s a great at a glance reminder.
CEO Fraud is a scam in which cybercriminals spoof company email accounts and impersonate executives to try and fool an employee in accounting or HR into executing unauthorised online transfers or sending out confidential tax information.
Also known as “Business Email Compromise” and BEC is defined as “a sophisticated scam targeting businesses working with foreign suppliers and/or businesses that regularly perform wire transfer payments. The scam is carried out by compromising legitimate business email accounts through social engineering or computer intrusion techniques to conduct unauthorised transfers of funds.”
The Four Attack Methods
Understanding the different attack vectors for this type of crime is key when it comes to prevention. This is how the bad guys do it:
1. Phishing
Phishing emails are sent to large numbers of users simultaneously in an attempt to “fish” sensitive information by posing as reputable sources—often with legitimate-looking logos attached. Banks, credit card providers, delivery firms, law enforcement, and the IRS are a few of the common ones. A phishing campaign typically shoots out emails to huge numbers of users. Most of them are to people who don’t use that bank, for example, but by sheer weight of numbers, these emails arrive at a certain percentage of likely candidates.
2. Spear Phishing
This is a much more focused form of phishing. The cybercriminal has either studied up on the group or has gleaned data from social media sites to con users. A spear phishing email generally goes to one person or a small group of people who use that bank or service. Some form of personalisation is included – perhaps the person’s name, or the name of a client.
3. Executive Whaling
Here, the bad guys target top executives and administrators, typically to siphon off money from accounts or steal confidential data. Personalisation and detailed knowledge of the executive and the business are the hallmarks of this type of fraud.
4. Social Engineering
Within a security context, social engineering means the use of psychological manipulation to trick people into divulging confidential information or providing access to funds. The art of social engineering might include mining information from social media sites. LinkedIn, Facebook and other venues provide a wealth of information about organisational personnel. This can include their contact information, connections, friends, ongoing business deals and more.
Who Are The Main Targets?
The CEO isn’t always the one in a criminal’s crosshairs. There are four other groups of employees considered valuable targets given their roles and access to funds/information:
Finance
The finance department is especially vulnerable in companies that regularly engage in large wire transfers. All too often, sloppy internal policies only demand an email from the CEO or other senior person to initiate the transfer. Cybercriminals usually gain entry via phishing, spend a few months doing recon and formulate a plan. They mirror the usual wire transfer authorization protocols, hijack a relevant email account and send the request to the appropriate person in finance to transmit the funds. As well as the CFO, this might be anyone in accounts that is authorized to transfer funds.
HR
Human Resources represents a wonderfully open highway into the modern enterprise. After all, it has access to every person in the organisation, manages the employee database and is in charge of recruitment. As such, a major function is to open résumés from thousands of potential applicants. All the cybercriminals need to do is include spyware inside a résumé and they can surreptitiously begin their early data gathering activities. In addition, W2 and PII scams have become more commonplace. HR receives requests from spoofed emails and ends up sending employee information such as social security numbers and employee email addresses to criminal organisations.
Executive Team
Every member of the executive team can be considered a high-value target. Many possess some kind of financial authority. If their email accounts are hacked, it generally provides cybercriminals access to all kinds of confidential information, not to mention intelligence on the type of deals that may be ongoing. Thus, executive accounts must receive particular attention from a security perspective.
IT
The IT manager and IT personnel with authority over access controls, password management and email accounts are further high-value targets. If their credentials can be hacked, they gain entry to every part of the organisation.
Here Are Eight Prevention Steps
Many steps must dovetail closely together as part of an effective prevention program:
Social engineering is the art of manipulating, influencing, or deceiving you in order to gain control over your computer system. The hacker might use the phone, email, snail mail or direct contact to gain illegal access.
Phishing, spear phishing, and CEO Fraud are all examples.
What is a social engineer?
OK, so who are these people? It could be a hacker in the USA who is out to do damage or disrupt. It could be a member of an Eastern Europe cybercrime mafia that is trying to penetrate your network and steal cash from your online bank account. Or, it could be a Chinese hacker that is trying to get in your organisation’s network for corporate espionage.
Top 10 techniques used by social engineers
Understanding the different attack vectors for this type of crime is key when it comes to prevention. This is how the bad guys do it:
Pretexting – An invented scenario is used to engage a potential victim to try and increase the chance that the victim will bite. It’s a false motive usually involving some real knowledge of the victim (e.g. date of birth, Social Security number, etc.) in an attempt to get even more information.
Diversion theft – A ‘con’ exercised by professional thieves, usually targeted at a transport or courier company. The objective is to trick the company into making the delivery somewhere other than the intended location.
Phishing – The process of attempting to acquire sensitive information such as usernames, passwords, and credit card details by masquerading as a trustworthy entity using bulk email which tries to evade spam filters. Emails claiming to be from popular social web sites, banks, auction sites, or IT administrators are commonly used to lure the unsuspecting public. It’s a form of criminally fraudulent social engineering. Also see Spear Phishing.
Spear phishing – A small, focused, targeted attack via email on a particular person or organisation with the goal to penetrate their defenses. The spear phishing attack is done after research on the target and has a specific personalised component designed to make the target do something against their own interest.
Water-holing – This technique takes advantage of websites people regularly visit and trust. The attacker will gather information about a targeted group of individuals to find out what those websites are, then test those websites for vulnerabilities. Over time, one or more members of the targeted group will get infected and the attacker can gain access to the secure system.
Baiting – Baiting means dangling something in front of a victim so that they take action. It can be through a peer-to-peer or social networking site in the form of a (porn) movie download or it can be a USB drive labelled “Q1 Layoff Plan” left out in a public place for the victim to find. Once the device is used or malicious file is downloaded, the victim’s computer is infected allowing the criminal to take over the network.
Quid pro quo – Latin for ‘something for something’, in this case it’s a benefit to the victim in exchange for information. A good example is hackers pretending to be IT support. They will call everyone they can find at a company to say they have a quick fix and “you just need to disable your AV”. Anyone that falls for it gets malware like ransomware installed on their machine.
Tailgating – A method used by social engineers to gain access to a building or other protected area. A tailgater waits for an authorised user to open and pass through a secure entry and then follows right behind.
Honeytrap – A trick that makes men interact with a fictitious attractive female online. From old spy tactics where a real female was used.
Rogue – Also, Rogue Scanner, rogue anti-spyware, rogue anti-malware or scareware, rogue security software is a form of computer malware that deceives or misleads users into paying for the fake or simulated removal of malware. Rogue security software, in recent years, has become a growing and serious security threat in desktop computing. It is a very popular and there are literally dozens of these programs.
Attacks
You may have heard of Norton antivirus, published by Symantec. The technical director of Symantec Security Response said that bad guys are generally not trying to exploit technical vulnerabilities in Windows. They are going after you instead.
“You don’t need as many technical skills to find one person who might be willing, in a moment of weakness, to open up an attachment that contains malicious content.”
Only about 3% of the malware they run into tries to exploit a technical flaw. The other 97% is trying to trick a user through some type of social engineering scheme. This means it does not matter if your workstation is a PC or a Mac. The last line of defence is… you guessed it: YOU!
How can you prevent attacks?
We’ve pulled together some resources to help you defend against social engineering attacks. A good place to start is ensure you have all levels of defense in depth in place. Keep reading below to find out how you can make yourself a hard target, get additional content for yourself and your users and stay up to date with social engineering in the news via our blog.
Social engineering attacks, including ransomware, business email compromise (BEC) and phishing, are problems that can never be solved, but rather only managed with a focus on security awareness training.
Start with a baseline phishing security test to assess your organisation’s baseline Phish-prone™ percentage
Run frequent simulated social engineering tests to keep users on their toes with security top of mind
Did you know that 77% of successful social engineering attacks started with a phishing email?
Find out what percentage of your employees are Phish-prone™ with your free Phishing Security Test. Plus, give them point-of-failure training using our Social Engineering Indicators feature. Go Phishing Now!
Social engineering tip sheet
The below infographic will show your users what to watch out for in emails. We highly recommend you print it out, it’s a great at a glance reminder.
Hosted by Gerard Brown at NetUtils and joined by guest speakers Ollie Pech, Channel MSP Manager and Javvad Malik, Security Awareness Advocate from KnowBe4 and known blogger and YouTuber within the infosec industry.
The title of this webinar poses a critical question all organisations should be asking themselves in this ever-changing world. While a layered security infrastructure is an absolute must to protect against the growing variety of threats organisations face today, there’s a hidden threat that is often-overlooked. What is this hidden danger… IT’S YOUR USERS?
The facts from NetUtils
Did you know, more than 90% of successful hacks and data breaches, all start with phishing scams? That’s a huge number considering the sheer volume of data breaches you hear about in the news on a daily basis.
According to the APWG Phishing Activity Trends Report for Q3 2019, phishing scams have reached the highest level in just three years, this level not seen since 2016! Below is a snapshot of the stats over the past year. What makes the chart of interest is the 46% increase of phishing sites detected between Q2 and Q3 of this year. And an almost 100% increase in phishing sites detected in Q4 of 2018, this time last year. *
* APWG Phishing Activity Trends Report Q3 – 2019
8 reasons why we partner with one of the best Security Awareness Training vendors in the industry
To help our customers educate their end users and to keep security top of mind!
The world’s largest integrated Security Awareness Training and Simulated Phishing platform, founded in 2010
With over 28,000 customers and 9.5million users KnowBe4 helps organisations manage an ongoing problem of social engineering
The ‘last layer’ of security is the Security Awareness layer, only really been taken into consideration over the last few years i.e. your human firewall
KnowBe4 have developed tremendously as a business from a “nice to have” within organisation to be a “must have”
Over a thousand training modules that are pre aligned to the platform that are all around security awareness and includes some HR modules and over 80 compliance modules
A simulated phishing platform with an iterative process; train, phish and analyse, all of the time
The KnowBe4 console helps organisations see where their end users are having trouble understanding security, this is backed up with over 1000 training modules to support learning. Not used to name and blame
Assists organisations in reducing malware infections, data loss and potential cyber threat, whilst increasing user productivity
Empowering Your Human Firewall
Always remember as a business you are dealing with human
beings and to do that, you have to understand behaviour and how to influence
that behaviour. Ultimately, the goal is, to move your staff from insecure
behaviours to better behavioural patterns so they can take a risk-based
approach to any actions they take.
There are 3 realities of Security Awareness:
Just
because I’m aware doesn’t mean I care
If you
try to work against human nature, you will fail
What
your employees do is way more important than what they know
Take the book by Daniel Kahneman called Thinking, Fast & Slow – there are 2 types of systems he outlines; System 1 called Fast Thinking, this is the way a person reacts to everyday routine, they don’t really think about the actions as this is just natural behaviour i.e. making a cup of tea. However, when we look at System 2 thinking referred to as Slow Thinking, this is used to solve specific problems when necessary, it’s more complicated and requires thought.
When it comes to Security Awareness and your organisation
you actually start with System 2, the Slow Thinking, to try and get people
really thinking. The more you do this the more it becomes a System 1 way of
thinking. That is why continuous awareness and training is vital. The goal, to
make Security Awareness a natural behaviour within your organisation, like making
that cup of tea, make it a habit over time and get that way of thinking
embedded into your company culture.
Your awareness program should NOT focus only on information
delivery. Do you care more about what your people know or what they do?
During our webinar Javvad revealed an interesting take away from Dr. BJ Fogg, known in the field of ‘Behaviour Design’ and The Fogg Behavior Model.
“Behaviour happens when three things come together at the same time: Motivation, Ability, and a Prompt to do the behaviour.”
Motivation – are your users sufficiently motivated to an action
Ability – do they have the ability to do that action
Prompt – the nudge to get them to do that action
Take these behaviours into consideration when designing your training programs so all boxes are ticked. Get specific as to what behaviours you want to change and target them.
Here at NetUtils we partner with KnowBe4 to help our customers educate their end users and keep security top of mind. Security Awareness Training should be part of your cyber security strategy and embedded into your cultural fabric especially when human error is still one of the leading causes of data breaches today.
To help you on your way we’ve got some cool FREE tools to get you started!
Free Phishing Security Test – Find out what percentage of your users are Phish-prone. Get yours here.
Free Email Exposure Check – Find out which of your users’ emails are exposed before the bad guys do. Get yours here.
Free Domain Spoof Test – Find out if hackers can spoof an email address of your own domain. Get yours here.
Free Phish Alert Button – Your employee’s now have a safe way to report phishing attacks with one click. Get yours here.
Ransomware Simulator – Find out how vulnerable your network is against ransomware attacks. Get yours here.
NetUtils Blog 