With cybercriminals always looking for the most successful way to carry out a successful attack, phishing once again proves to be one of the most adaptable and viable attack vectors.
Over the years, attackers have looked for new ways to gain access to an organization’s network. Years ago, it was SQL Injection attacks. More recently the industry has been plagued with remote desktop-based attacks. But throughout the years, one attack vector has remained near or at the top of the list: phishing.
It just makes sense – email-based phishing attacks allow the cybercriminal access inside your corporate network, given a chance to execute…IF their phishing scam is good enough to fool the email recipient – your user.
According to the X-Force Threat Intelligence Index 2020, produced by IBM X-Force Incident Response and Intelligence Services (IRIS), phishing is still the number one attack vector in use today.
In a close race, phishing just edges out scanning for and exploiting vulnerabilities and unauthorized use of credentials. IBM X-Force also notes that Phishing – representing the attack vector used in 31 percent of attacks – is, technically, down from 44 percent in 2018. Even so, first place is first place. And that means it’s a clear indicator where organizations today need to place a cybersecurity focus.
You can put email scanning, DNS lookups, and endpoint-based antivirus in place, but the most mature security models understand – and, frankly, expect – some measure of phishing emails will still make it past layered security controls. And so, Security Awareness Training needs to be added to the layered security strategy, leveraging the user as an additional security measure. When users are educated on what phishing attacks look like, they can more easily spot scams without putting the organization at risk by engaging with email-based malicious content.
Phishing isn’t going anywhere. Employ your users to make your organization more secure through Security Awareness Training.
