By Jess Coburn
Special to the Sun Sentinel
Oct 01, 2021 11:45 AM
Thank you for supporting our journalism. This article is available exclusively for our subscribers, who help fund our work at the Sun Sentinel.
Jess Coburn (Jess Coburn)
Not a day goes by that we don’t hear about the devious actions of hackers seeking financial gain through phishing expeditions. The results render large businesses, municipalities, school systems, hospitals, and individuals helpless, forcing them to write large checks to retain control of their data.
Unfortunately, these individuals are becoming more sophisticated leaving anyone who has a computer vulnerable. For years, October has been designated National Cybersecurity Awareness Month. This observance reminds us to be wary 24/7, 12 months a year, and recognize that every time we turn on our computer, open an email, or respond, our information becomes vulnerable.
Here are some recent examples of organizations being held hostage due to an employee’s unknowing action:
- The city of Naples, Florida recently paid a hacker $700,000 because an employee thought he/she was responding to a familiar vendor.
- Lake City, Florida paid $460,000 to recover data.
- Jackson City, Georgia paid $400,000 to recover data.
Since employees are the most common gateway for hackers, organizations must take these threats seriously and continually educate them on ways to recognize and ignore these attacks.
First, let’s take a look at the serious nature of these phishing efforts:
- Spam accounts for 85% of all emails.
- Another study showed that 56% of CISOs felt that defending against the user behavior of clicking a malicious link in an email is very or extremely challenging, ranking higher than any other security concern.
- Verizon’s 2018 Data Breach Investigations Report says email is the most common method for malware distribution (92.4%) and phishing (96%). Why? Because it works.
- The volume of spam email is currently at a 15-month high, according to Talos Intelligence data, and the number of new phishing domains has shown a 64% increase from January through March 2019, indicating that attackers could be gearing up for more phishing attacks.
It’s clear hackers will continue their efforts simply because they stand to benefit. With billions of users, there are plenty of potential victims.
Here are a few of the tactics that are fairly common and easily identified:
- Email from Amazon that your new laptop couldn’t be delivered, except you didn’t order a laptop.
- Email from Office 365 that your password is expiring in 48 hours and you need to log in and change it immediately or lose access to email.
- Email from the IRS that your tax refund was just deposited in your bank account at Washington Mutual but you don’t have an account at Washington Mutual.
Here are a few more red flags indicating you’re being targeted:
- Email from a known contact but the email address is wrong. Always check the sender’s email address and when you click “reply” look at the email address it’s going to.
- Misspellings, typos, grammatical errors on the emails and landing pages.
- Landing pages that are missing images, don’t use https or the URL looks wrong. Example: www.microsoft.com.bobsblog.org or mail-rnicrosoft.com or microsoftt.org.
- Requests that are out of the norm. Request to immediately send a wire, buy a gift card or do an action but not to reach out to me because I’m getting on a plane, going into a meeting, etc.
- Run phishing simulations where you send your employees actual phishing emails and use it as a way to teach them what to look for.
- Ensure software is updated from the servers to desktops and even your mobile devices and smartphones are up to date.
- Invest in modern security solutions like time-of-click email protection, attachment sandboxing and detonation.
- Upgrade from traditional antivirus software to Endpoint Detection and Response solutions like Sentinel One, Microsoft Defender ATP or Cylance
- Provide training that’s tailored around current and modern threats.
- Leverage alternative training mediums like posters, animations, movies and online classes and provide them in micro-training nuggets throughout the year so the information remains fresh and current.
- Users: check the sender’s email address against the message signatory; do they match? If not, don’t touch it.
Improving cybersecurity efforts must be part of corporate culture, and it’s the responsibility of management to continually educate employees on the risks and consequences of not following established protocols.
Morning Update Newsletter
Weekdays
Start your day with the top stories in South Florida.
Developing cybersecurity policies are moving targets. They change daily as hackers devise new and creative ways to trick us.
The key is to stay steps ahead of the hackers and their efforts to extort money from our organizations. This can only be done with trained IT departments that can identify new threats and respond with firm policies and educational programs.
Jess Coburn is president and founder of Boca Raton-based Applied Innovations (appliedi.net), a firm that has helped businesses succeed in the cloud since its inception in 1999.
