Phishing and Social Engineering
What Is Phishing?
Phishing is a type of cyber attack in which an attacker attempts to trick the victim into divulging sensitive information usually by persuading them to click on a malicious link, download an attachment containing malware, or redirect the victim to a fake website where they’re asked to enter their credentials.
The importance of Phishing Exercises
Phishing exercises fall squarely under the umbrella of cybersecurity education and awareness, and they are one of the single most effective things an organization can do to prevent incidents. The vast majority of breaches actually begin with a phish. Many threat actors obtain their initial foothold on victim networks through phishing emails which makes the employees of any business the most fruitful attack surface for an adversary.
When should you conduct an Phishing Exercise?
Ideally, all the time. Because cybersecurity is always a game of cat-and-mouse, an organization is never really “done” with training its employees on the dangers of phishing. Hence, it should be an ongoing effort in which the phishes evolve and adapt to emulate what the industry is seeing. As employees begin to positively delineate phishes from legitimate emails over time, the phishing exercise should increase in difficulty.
How does Phishing work?
Enterprise phishing works by carefully crafting illegitimate, but benign, phishing emails and continuously delivering them to employees while meticulously tracking metrics on things like number of users who clicked a link, downloaded an attachment, read the email but didn’t take action, read the email and reported it as a phish, which departments have the lowest/highest click-rate etc… This data gives your organization information to pivot off of and identify which users are most prone to introducing malware into the network.
Stakeholders
- Information Security Team: The information security team is responsible for planning and executing the enterprise phishing exercise, including creating the phishing email, monitoring the response, and analyzing the results.
- Executive Leadership: Executive leadership is responsible for providing support and resources for the enterprise phishing exercise and communicating the importance of the exercise to the organization.
- Corp Comms: The human resources department is responsible for communicating with employees about the enterprise phishing exercise, including providing information about the purpose of the exercise and the expected outcomes.
- Employees: Employees are the target of the enterprise phishing exercise and are responsible for recognizing and reporting suspicious emails or other communications.
Deliverables
- Metrics and Data Analysis: Valuable insight into which departments and employees are most susceptible to phishing emails. What types of language in phishing emails solicit the high click rates. What types of links and documents are users most likely to click, download, and ignore.
- Training: Once the data has been analyzed, it needs to be operationalized in order for it to be useful. This means getting repeat-offenders into phishing education and training classes. Typically these are conducted by a member of the infosec staff but the trainings can be outsourced to a vendor or some third-party platform
Benefits
Black Cat Security already comes equipped with proprietary and commercial tools for tailoring phishing exercises to your business. We take your business operations into consideration when conducting an exercise in order to reveal a more accurate measure of the threat your attack surface. More importantly however, Black Cat provides top-tier, personalized, and meaningful cybersecurity training that ensures your users walk away more prepared to defend against phishing attempts.
