Phishing remains one of the oldest and most persistent attack methods for hackers trying to break into an organisation, and potential targets continue to use simulated phishing attacks as one of the primary ways to ensure their staff are ready to defend against it.
However, these spoof attacks aren’t always well-received, and employees can frequently feel unfairly trapped or caught out by these tests. Appearing on this week’s podcast to discuss why phishing simulations are often so poorly received, the value that they offer as part of a wider security strategy and how organisations can deploy them more effectively is Paul Watts, ex-CISO, former IT Pro Panellist, and distinguished analyst for the Information Security Forum.
Highlights
“I'd be lying if I said I haven't been implicated in a couple of phishing exercises that might be maybe cutting it a little bit close. But, you know, you've got to have a sense of emotional intelligence, you've got to understand how your business is thinking and feeling, and there are some areas where you probably shouldn't venture. But what I would say is this: phishing plays on the significance of social engineering to threat actors. And unfortunately, social engineering plays on basic raw human emotions.”
“One of my most favourite phishing campaigns or simulation exercises we did was we wrote to all of the senior leaders to say, your Avios miles are going to expire in the next few days. It was an absolute frenzy. The PAs were mustering to log in and spew their details into this, because God forbid you're going to take an exec's airmiles or airline privilege away from them! It just comes back to exactly what I said; you press the right buttons in the right order, and people will lower their shields and they will fall for it.”
“It's easy to talk about the number of incidents, but more valuable is talking about the times you nearly got caught and celebrating that. And building on that, and that culture that actually, the right thing to do, to be celebrated is to call out when you think something's happened, or you responded to something that you perhaps shouldn't have done, or you're in any way uncertain. To know that you can do that without fear of reprisals, or recriminations or punitive actions is absolutely critical; you can then start to think about what are the most specific threats to your organisation right now, and then focus on those.”
Read the full transcript here.
Footnotes
- What is phishing?
- What makes for the most deceptive phishing attacks?
- Five giveaways that show an email is a phishing attack
- Kaspersky finds most effective phishing emails imitate corporate messages, delivery notifications
- Microsoft unveils wide-scale phishing campaign that circumvents MFA
- LinkedIn phishing attacks have surged 232% since start of February
- One in eight Americans would fall victim to a phishing attack
- 10 quick tips for identifying phishing emails
- Report: IT staff fail phishing tests more often than non-technical workers
- Phishing scam convinces US government to pay $23.5 million to cyber criminals
- Almost half of UK employees can't spot email scams
- Just 3% of employees cause 92% of malware events
- Train firm slammed over 'bonus' phishing test
- Tribune Publishing staff enraged after phishing test promises $10k bonuses
- How to patch your security without unravelling the relationship with your staff
- Panel Profile: Kantar CISO Paul Watts
- IT Pro Panel: Return to sender
Subscribe
-
Bigger salaries, more burnout: Is the CISO role in crisis?In-depth CISOs are more stressed than ever before – but why is this and what can be done?
-
Cheap cyber crime kits can be bought on the dark web for less than $25News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
The new era of cyber threatsITPro Podcast With AI-powered attacks and state-backed groups, security teams face face a new wave of sophisticated threats
-
Supply chain scares and Google’s AI codeITPro Podcast As the ransomware attack on Blue Yonder disrupts a wide range of firms, Google moves to lead by example on internal AI code
-
Halloween special: Cybersecurity horror storiesPodcast Join us for three terrifying tales sure to chill any IT professional to the core
-
Securing your business with education and trainingITPro Podcast Keeping your workforce updated on the latest threats requires a cohesive cyber skills strategy
-
Cracking open insider threatsITPro Podcast Leaders need to perform strict identity measures on would-be hires – and ensure employees who leave have access promptly removed
-
Protecting the public sector from hackersITPro Podcast With the public sector facing increasingly sophisticated threat actors, leaders need centralized security plans and better communication
-
How cyber attacks damage mental healthITPro Podcast As staff struggle to cope in the immediate aftermath of a cyber incident, leaders must do more to foster a culture of support
-
LockBit leader revealed: What it means for ransomwareITPro Podcast With LockBit's founder having been unveiled publicly and with international law enforcement still digging into detailed attack stats, the group is on high alert
