Notes on Social Engineering, and What to Do About It

social engineering phishing attackPhishing attacks are growing in prevalence during the pandemic, according to David Dufour, Vice President of Engineering and Cybersecurity at Webroot. Webroot’s recent threat report concludes that people are receiving 34% more emails than before the pandemic, and this increase was accompanied by an uptick in phishing attacks.

“Well, I think none of this will be surprising, but it's just kind of critical to bring up so people are keeping it top of mind,” Dufour said. “A lot of things are, hey, make a donation or, you know, click here, click this link to be able to donate to help COVID survivors or things of that nature. Or maybe, hey, you want to get your stimulus check quicker, click this link and give us your account information, and we'll get your stimulus check deposited in, you know, a few minutes. None of that is true…They're just trying to get you to click that link.”

Dufour added that the combination of the increase in email volume and the distractions of working from home creates a perfect environment for phishing attacks to succeed.

“The problem that we're seeing is kind of twofold,” Dufour said. “One – people are getting inundated with emails from colleagues or, you know, customers even, where it may be coming from their personal account, it may be coming from their business account because everyone's working at home, so they're getting a lot of email from unfamiliar places, and some of it's legitimate for them to do their job. And the other big issue is you're at home with little Susie or little Johnny from school and you're trying to make them lunch and you're trying to answer emails and you're trying to respond to your boss, and so there's also a distraction factor, where people aren't as focused on what they're reading and they're more apt to click as well.”

Dufour concluded that employees want to learn how to make smarter decisions, and organizations need to help educate them.

“The security industry has realized that the user is not as dumb as we want to make them out to be,” he said. “People really want to do the right thing. If we can educate them – like I said, most people know what phishing is. We just gotta keep it top of mind and in their brain to be aware of it. But on top of that, the thing that people really need to be doing is slowing down and taking the time to read what's going on. And if you're in a busy spot, maybe don't answer your email. Set aside some time when you can do it thoughtfully.”

New-school security awareness training can create a culture of security within your organization by teaching your employees how to avoid falling for social engineering attacks.

The CyberWire has the story.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Ransomware Hostage Rescue Manual

Get the latest about social engineering

Subscribe to CyberheistNews