Fighting phishing and social engineering

Roger A. Grimes at KnowBe4 shares insights on how to defend against cyber-criminals using social engineering as a way of hacking databases

 

Phishing attacks represent a pervasive and insidious threat that exploit the digital communications we have come to rely on and take advantage of human psychology to deceive individuals and organisations into divulging sensitive information.

 

The numbers speak for themselves: last year, Comcast reported a staggering nearly 90% of attacks on their customers started with a phishing attempt; and a study of more than 40 threat intelligence reports by a colleague, Javvad Malik concluded that social engineering or phishing were consistently the root cause of hacking long term.

 

As the lead data-driven defence evangelist at KnowBe4, I’ve dedicated my career to combating these malicious tactics and empowering individuals and organisations to defend against them effectively. 

 

Understanding social engineering and phishing

Social engineering is a malicious form of manipulation employed by cyber-criminals to exploit human psychology and trick individuals into divulging confidential information or performing actions that compromise security.

 

Phishing, a subset of social engineering, typically involves fraudulent emails, text messages or other online media messages masquerading as legitimate entities to deceive recipients into providing sensitive data or downloading malware.

 

The dangers of phishing

Phishing attacks pose multifaceted dangers to cyber-security, undermining trust, compromising sensitive data and inflicting financial and reputational damage - not to mention the emotional trauma victims can experience as a result.

 

By exploiting human vulnerabilities rather than technical weaknesses, phishing attacks can bypass traditional security measures, making them particularly deceptive. Because it is digital, phishing easily scales and is low-risk, high-reward for hackers. Millions of people and companies lose billions of dollars each year to these types of scams.

 

Defending against phishing

Effective defence against phishing requires a varied approach encompassing education, technology as well as robust policies - and make no mistake, defending is hard. Here are key strategies for fortifying your defences:

 

Education and awareness: Empower users with the knowledge to identify and evade phishing scams through comprehensive training programmes. Teach them to recognise common phishing tactics or red flags, such as spoofed email addresses, urgent requests for personal information and suspicious attachments or links.

 

Vigilance and scepticism: Instil a culture of vigilance and scepticism, encouraging users to scrutinise incoming communications and verify the authenticity of requests before taking action. Remind them that legitimate organisations will never ask for sensitive information via email or text message or coordinate a passphrase that could be used if the CEO is legitimately asking for a money transfer or other large purchase, for example.

 

Technical solutions: Deploy advanced email filtering and anti-phishing tools capable of detecting and blocking suspicious messages in real-time as well as endpoint defences, network and server defences, password managers, VPNs - and don’t forget patch management, change and configuration management and mobile device management. Sounds simple, right? One often misunderstood technical control is multi-factor authentication (MFA), with users thinking it is unhackable. To get MFA right the first time, make sure to implement phishing resistant multi-factor authentication which will add an extra layer of security to user accounts, mitigating the risk of unauthorised access.

·   

Incident response and forensic examination: Develop robust incident response protocols to swiftly identify and mitigate phishing attacks when they occur. Establish clear procedures for reporting suspected phishing attempts and conducting thorough investigations to contain breaches and prevent further spread.

 

Data protection: Implement encryption protocols to secure sensitive data, rendering it unreadable to unauthorised parties in the event of a breach. Regularly backup critical data to ensure rapid recovery in case of data loss or corruption.

 

Developing effective policies

In addition to technical measures, organisations must develop comprehensive policies to address the most common types of social engineering and phishing attacks, including Acceptable Use, General Cyber-security, Anti-Phishing and Corporate Security Awareness Training (SAT) policies.

 

Key policy considerations include:

 

Password management: Enforce strict password policies, requiring users to create complex, unique passwords and regularly update them. To help, use a password manager to create and use strong passwords, as well as securely store and manage credentials. All user accounts should be protected by a strong password or phishing-resistant MFA, or both. Think about the accounts and admin protection and authentication and ensure controls are appropriate. Make sure passwords are never shared by employees over email, voice call or text message.

 

Access controls: Limit access to sensitive systems and information to authorised personnel only, employing role-based access controls to enforce the principle of least privilege. Users performing administrative tasks should be given both administrative and non-administrative accounts to limit non-administrative tasks like internet browsing, file downloads, research etc being done on an administrative workstation.

 

Employee training: Mandate regular security awareness training for all employees, covering topics such as phishing prevention, data protection best practices, and incident response protocols. Training should be consistent and performed on an at least monthly basis and this should be clearly communicated to staff, which will help them understand why it is so important.

 

Regulatory compliance: Ensure compliance with relevant regulatory frameworks, such as NIST, GDPR and HIPAA, by implementing appropriate security measures and data protection practices. For example, when it comes to vulnerability scanning and patch management, these should be performed at least weekly and checked against the CISA Known Exploited Vulnerability Catalog and resolved within two weeks, sooner if possible.

 

Defending against social engineering and phishing requires a proactive and many pronged approach encompassing education, technology and robust policies.

 

By equipping individuals and organisations with the knowledge and tools to recognise and combat phishing attacks, we can collectively strengthen our cyber-security defences and safeguard valuable data. 

 

---

 

Roger A. Grimes is data-driven defence evangelist at KnowBe4. The list of actions to fight social engineering and phishing he provides in this article is expanded in his new book in Fighting Phishing: Everything You Can Do to Fight Social Engineering and Phishing available now from Amazon

 

Main image courtesy of iStockPhoto.com and Just_Super