Social Engineers Earn a First

A study by nonprofit research company Jisc and the UK’s Higher Education Policy Institute (HEPI) found that 100 percent of spear phishing tests against universities were able to gain access to sensitive data within two hours. The tests targeted students and staff members at 173 institutions.

White-hat hackers from Jisc used publicly-available information about the universities and their staff members to construct tailored phishing emails, and successfully gained access to research databases, financial systems, or personal information at every participating university. In some cases, this took them less than an hour.

Douglas Bonderud, writing for IBM’s SecurityIntelligence blog, says the lesson here is that “well-written phishing emails are corporate compromise kryptonite.” He recommends that organizations focus on the way employees interact with emails to combat this threat.

“Avoiding the spear phishing hook starts with recognizing the critical link between employees and email,” Bonderud writes. “Most users believe they’re above average when it comes to recognizing the danger signs of phishing, but this doesn’t pan out in practice. By implementing low-key warning processes that recognize key phishing tactics, companies can ensure staff are notified without fighting the ‘it won’t happen to me’ battle.”

Email filters and anti-phishing technologies are essential tools to defend against these attacks, but spear phishing emails are particularly difficult to block, since attackers put in extra effort to ensure that their emails bypass these measures. New-school security awareness training can help your employees identify these emails by teaching them how to confirm that requests for information, access, or money are legitimate before following through.

SecurityIntelligence has the story: https://securityintelligence.com/news/spear-phishing-report-card-perfect-scores-in-school-security-pen-testing/

Free Phishing Security Test