Greed is another motivator that attackers will use to draw people in. One such example is a message from the company stating that, due to a particularly successful year, a raffle will be held where one employee will win a prize Ė it could be a gift card, a holiday, or even a car. Everyone is encouraged to click a link to enroll in the scheme.
Opportunistic messages can also be successful. For example a free lottery to win tickets to the Olympics, every tax season we see a spike in emails claiming to be from HMRC, and even the U.S. presidential elections were used to try to trick people.
While these are the types of themes phishers will use, timing is another tactic they employ. Many successful phishing attacks are launched on Monday mornings and Friday afternoons as this is the time people tend to spend clearing their inboxes and can be distracted more easily.
With the growing sophistication of phishing attacks, what can people do in order to protect themselves?
The best form of defence is vigilance, as all too often security controls alone are not enough.
At the very least Ė ALL electronic communications should be treated with caution. Even a message from a trusted friend or colleague may not be from who it purports to be. In a corporate environment, itís important that every employee recognises the part they play in the organisationís security posture as a whole.
If you receive an email attachment that you werenít expecting donít just open it Ė instead check with the sender that they did indeed send it. While it may take an extra 10 seconds, it could save hours or even days if the attachment proves to be malicious.
Everyone should learn how to read URLs to readily identify which are genuine and which arenít as attackers often try to entice victimís to click on a link to a website they control by making it look legitimate.
As an organisation, instead of solely relying on technical controls, spend quality time educating the employee base. And I donít just mean putting up a few posters as these passive techniques, alone, are not enough. You need to take a pro-active approach and immerse people in on the spot training with true-to-life experiences and scenarios. This way user behaviour can be changed and the message is more likely to be remembered.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.