As organizations look to improving their defenses, it’s worth remembering that attackers usually get through those defenses by manipulating the human beings those security measures are in place to protect. A recent warning on increased phishing attacks worth taking to heart comes from Deloitte Malaysia Cyber Risk, Risk Advisory executive director Ho Siew Keient.
“Fraud, identity theft, and scams are a big motivator for attackers to connect with individuals – for example, harvesting information based on an individual’s social media presence may allow attackers to impersonate the individual for identity theft, or as a platform to launch social engineering attacks on an individual’s contacts and friends.” he warned this weekend in the Borneo Post.
We tend to think of the principal consequences of a data breach as being immediate and personal: the attackers have people’s information and will use it to, for example, apply for loans, open credit card accounts, make online purchases and the like. But see Ho’s observation to the effect that impersonation is also used to facilitate social engineering. As the Borneo Post notes, “most cyber attacks begin with a phishing email to an unsuspecting victim.”
Thus personal, individual security awareness on the part of employees is an essential line of defense for organizations of all kinds, sizes, and missions. “As access to corporate networks and applications are increasingly through corporate mobile devices or employee personal devices under BYOD schemes, poor cyber hygiene at an individual level does have a direct impact on enterprise security – and attackers are certainly leveraging on individuals as the entry point to corporate systems and data,” Ho points out.
Raising awareness of the possibilities of social engineering and educating people to a healthy skepticism concerning online communications are important. So is encouraging employees to be more reticent about themselves in cyberspace. “Be careful of whom you accept as friends and be careful of revealing excessive private information through social media or job posts,” Ho said.
Helping people become alert to security threats is good for them and good for business. New-school security awareness training can provide your employees with essential knowledge tailored to threats they face.
The Borneo Post has the story: https://www.theborneopost.com/2019/12/30/ho-most-cyber-attacks-begin-with-phishing-emails/
