Notes on Social Engineering, and What to Do About It

Phishing attacks are growing in prevalence during the pandemic, according to David Dufour, Vice President of Engineering and Cybersecurity at Webroot. Webroot’s recent threat report concludes that people are receiving 34% more emails than before the pandemic, and this increase was accompanied by an uptick in phishing attacks.

“Well, I think none of this will be surprising, but it's just kind of critical to bring up so people are keeping it top of mind,” Dufour said. “A lot of things are, hey, make a donation or, you know, click here, click this link to be able to donate to help COVID survivors or things of that nature. Or maybe, hey, you want to get your stimulus check quicker, click this link and give us your account information, and we'll get your stimulus check deposited in, you know, a few minutes. None of that is true…They're just trying to get you to click that link.”

Dufour added that the combination of the increase in email volume and the distractions of working from home creates a perfect environment for phishing attacks to succeed.

“The problem that we're seeing is kind of twofold,” Dufour said. “One – people are getting inundated with emails from colleagues or, you know, customers even, where it may be coming from their personal account, it may be coming from their business account because everyone's working at home, so they're getting a lot of email from unfamiliar places, and some of it's legitimate for them to do their job. And the other big issue is you're at home with little Susie or little Johnny from school and you're trying to make them lunch and you're trying to answer emails and you're trying to respond to your boss, and so there's also a distraction factor, where people aren't as focused on what they're reading and they're more apt to click as well.”

Dufour concluded that employees want to learn how to make smarter decisions, and organizations need to help educate them.

“The security industry has realized that the user is not as dumb as we want to make them out to be,” he said. “People really want to do the right thing. If we can educate them – like I said, most people know what phishing is. We just gotta keep it top of mind and in their brain to be aware of it. But on top of that, the thing that people really need to be doing is slowing down and taking the time to read what's going on. And if you're in a busy spot, maybe don't answer your email. Set aside some time when you can do it thoughtfully.”

New-school security awareness training can create a culture of security within your organization by teaching your employees how to avoid falling for social engineering attacks.

The CyberWire has the story.