As organizations look to figure out where to strengthen their cybersecurity strategy, industry data provides guidance by pointing at one of the most common aspects of cyberattacks for clues.
Every cyberattack that requires the intervention of its victims to be successful needs some means of getting the victim’s emotional investment in order to persuade them to perform the desired action (be it clicking a link, opening an attachment, or complying with a request). To attain this emotional investment, the bad guys constantly use social engineering tactics. Whether it’s impersonating an individual or a brand, using current events, or offering something the victim wants or needs, social engineering is the critical part of an attack that helps cybercriminals achieve their malicious goals.
We’ve already known that 91% of cyberattacks begin with spear phishing, but data from security vendor purplesec suggests that social engineering is even more pervasively used than even phishing, citing that 98% of cyber attacks rely on social engineering!
According to the purplesec data:
- 43% of IT professionals say they have been targeted by social engineering schemes in the past 12 months
- New employees are most susceptible to socially engineered attacks, with 60% of IT professionals citing recent hires as being at high risk
- 21% of current or former employees use social engineering themselves to gain a financial advantage, for revenge, out of curiosity or for fun
Because of the convincing nature of some of the social engineering tactics used, it’s important for your users to keep their defenses up, realizing that an email isn’t necessarily from who it says it’s from, and that any opportunity offered isn’t necessarily real or sincere in nature. Users that undergo new school Security Awareness Training are less prone to fall for social engineering, as they are taught to recognize the unmistakable signs that exist in each attack that can give away the email’s true intentions.
