This latest statistic takes the spotlight off of antivirus as the protector, and puts the focus squarely in the hands of your users to stop attacks.
Security vendor, Barracuda Networks recently released their findings after analyzing over 3,000 Business Email Compromise (BEC) attacks. These attacks leverage company email purporting to be someone within the organization, and have one of four objectives in mind:
- Establish rapport
- Get the recipient to click a malicious link
- Steal personally identifiable information
- Obtain a Wire Transfer
You might think emails are always coming from or sent to the CEO, CFO, etc. But, according to Barracuda, nearly 50% of the time, emails appear to come from someone other than your C-suite, HR, or Finance. And nearly 55% of the time, the intended recipient also falls outside those same roles.
While “CEO Fraud” is the primary focus (as emails appear to come from the CEO just over 40% of the time), the fact that so many attacks come from and are sent to users within your organization should put the entire org on alert.
Lastly, because only 40% of BEC attacks use a malicious link (most are malware-less, using social engineering tactics to establish credibility and gain the confidence of the recipient), your antivirus solutions are potentially powerless to stop these attacks before they reach an Inbox.
Cybercriminals do their homework in these kinds of scams, leveraging social media, LinkedIn, and other sources of detail to inject contextual details into the emails sent. So, your users need to be on high alert – especially when the email appears to come from someone known to them.
Barracuda suggests the following actions be taken:
- Only approve wire transfers after an in-person conversation with the sender
- Be vigilant when receiving emails from the CEO
- Deploy email protection in addition to antivirus
- Implement Security Awareness Training, along with phishing testing to keep employees updated on modern phishing techniques.
Will your users respond to a spoofed email?
KnowBe4's new Phishing Reply Test (PRT) is a complimentary IT security tool that makes it easy for you to check to see if key users in your organization will reply to a highly targeted phishing attack without clicking on a link. PRT will give you quick insights into how many users will take the bait so you can take action to train your users and better protect your organization from these fraudulent attacks!
Here's how the Phishing Reply Test works:
- Immediately start your test with your choice of three phishing email reply scenarios
- Spoof a Sender’s name and email address your users know and trust
- Phishes for user replies and returns the results to you within minutes
- Get a PDF emailed to you within 24 hours with the percentage of users that replied
PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:
