Microsoft’s security team is uniquely positioned to analyze trends in cyber security threats. Their frequent Security Intelligence Reports (SIR) are an excellent indicator of these trends. Redmond's numbers are based on their internal scan of O365 email addresses. Get the latest SIR here.
And here is the big news
The most recent SIR indicates that phishing attacks are now by far the most frequent threat to the cyber landscape, increasing a massive 250% since the publication of the previous report. They analyzed over 470 billion and concluded that not only are phishing attacks much more frequent, but also significantly increased in sophistication in a short amount of time.
Phishing Is Now The Criminal Preferred Practice
Phishing attacks have been trending upward for some time, but Microsoft’s data indicates that they are now becoming the preferred practice of criminals. The techniques employed are also quite diverse. Attackers are often able to convincingly impersonate users and domains, bait victims with fake cloud storage links, engage in social engineering and craft attachments that look similar to ones commonly used in the organization, among other attack types.
Adding Insult To Injury
The additional problem is that phishing scams are more sophisticated, but they are also more accessible to unsophisticated operators. Phishing kits, which clone popular websites and operate from temporary servers, can be purchased from underground dealers for relatively small prices by any aspiring cyber criminal with the cash. These “out of the box” solutions simply require attackers to forward a prefab email with malicious links already embedded to their desired targets.
Staying off the hook
When you look over the full list of phishing attacks in the Security Intelligence Report, it’s striking how simple diligence can defeat just about all of them.
Most of these phishing messages succeed through social engineering tactics, leveraging blind trust, impulsiveness and lack of awareness. Proper organization-wide security awareness training in recognizing common phishing approaches and request response policies can drive down the phish-prone percentage of users dramatically. Of course, organizations must be just as diligent about verifying that their vendors are doing the same. CPO Magazine has the story
Find out how affordable new-school security awareness training is for your organization. Get a quote now.
