Protect Your Employees From Phishing And Social Engineering Attacks

High-profile security breaches have prompted many hardware and software providers to implement stringent protections and secure defaults.

- David Benas

As a direct result of their actions, finding typical “low-hanging fruit” vulnerabilities to breach organisations are becoming much more difficult, expensive, and a noisy attack vector. Instead, attackers are turning to a new organisational attack vector: its people.

Let’s consider how an organisation can put security controls in place around its people, without violating their privacy and productivity.

TRAINING YOUR EMPLOYEES

When it comes to planning an exploit, employees are the path of least resistance to attackers. All it takes is one vulnerable user for a breach to occur. An unaware user is an easy target, and easy targets are ripe for a wide dragnet phishing attack (that is, a phishing attack that covers a large part of the organisation, often with the simple goal of harvesting credentials and valid identities or compromising users’ laptops with malware).

The solution: regular training to establish a baseline of user phishing awareness, along with intermittent employee reminders reinforcing what they’ve learned in training sessions. Training should provide users with examples of phishing attacks, context on how to spot such attacks, and steps to take if they feel they might be the target of a campaign.

Another good practice is to frequently conduct red team engagements to challenge the organisation’s security effectiveness. We’ve discovered that this training can guard against even advanced dragnet campaigns.

Organisations that have a phishing awareness program will often spot the campaign due to user reports and blacklist the source within a matter of hours.

Employees are also likely to broadcast their involvement in phishing awareness programs on their resumes and professional social media network profiles (such as LinkedIn). This is likely to deter an attacker harvesting user information from publicly available resumes and social media pages.