Organizations have to acknowledge their responsibility for ensuring their employees are able to recognize targeted phishing attacks, according to James McGachie, Legal Director of DLA Piper Scotland. Writing in The Herald, McGachie explains that sophisticated spear phishing attacks designed to steal large amounts of money (also known as "whaling"), should be of special concern to companies.
McGachie cites a recent case Scotland in which an employee of a media company fell for a spear phishing attack that arrived by email and was and was tricked into transferring £193,250 to an attacker. The employee was subsequently sued by her employer for the money, with the company arguing that the employee breached her contract by failing to exercise reasonable care. The company held that the phishing emails were “obviously fraudulent.”
The judge ultimately ruled that the employee wasn’t responsible for reimbursing the company for the stolen funds, since she didn’t know she was communicating with a fraudster.
McGachie explains that “while holding that the decision to transfer company funds without any authority was in breach of contract, Lord Summers did not consider that the loss that ensued was the natural consequence of the breach, finding that it was ‘exceptional and unnatural’ because the controller was unaware of the fraud being perpetrated. Accordingly, the action was dismissed.”
McGachie stressed that organizations need to realize their responsibility in this realm before it’s too late.
“From a practical perspective the case highlights the need for employers to ensure staff – particularly those in cash or credit control handling functions – are fully trained and aware of the tell-tale signs of both phishing and whaling scams,” McGachie writes. “Such training may take the form of practical testing through running ‘spot checks’ through deploying ‘test’ phishing and whaling messages to establish if the training has been successful.”
Employees shouldn’t be held responsible for falling for social engineering attacks, especially if they haven’t been taught how to defend themselves. New-school security awareness training can give your employees experiential knowledge of these attacks.
Microsoft has the story: https://www.microsoft.com/security/blog/2019/12/11/the-quiet-evolution-of-phishing/
