It seems like I’ve been writing about phishing a lot lately, but there is a good reason for that. Phishing is effective. It is wreaking havoc on networks and endpoints and continues to fool even sophisticated users. And here’s another reason why I feel the need to discuss the concerns surrounding phishing: A new study found that IT executives are worried about email-related threats.
In its report, PhishMe found that 90 percent of executives worry most about email-related threats like phishing and spearphishing attacks, and for good reason. While 100 percent of respondents said they have layers of security in place to combat cyberattacks, two-thirds admit they’ve had to deal with a security incident that originated with a phishing email.
As the report stated, we aren’t winning the war against phishing. We are simply holding ground, and I’d say, in many cases, just barely holding ground.
It’s easy to see why. According to the report, a third of the respondents said they see 500 or so suspicious emails a week and they are getting through filtering systems, yet only a little more than a quarter have a dedicated inbox for phishing spam investigation. As the report stated:
With the average office worker receiving 122 emails each day, it’s no wonder phishing is the top attack vector in data breaches. Now imagine being a small team of incident responders receiving every forwarded employee email, some truly suspicious, some just spam.
Rohyt Belani, co-founder and CEO of PhishMe, said in a formal statement:
Despite continued investment, phishing emails continue to bypass perimeter technologies to reach employees’ inboxes every day. However, conditioned employees often report these emails to their internal security teams via an abuse inbox. Our goal at PhishMe is to help incident response teams across the world to rapidly process the abuse inbox by weeding out the benign emails from the malicious ones and operationalizing the blocking of the latter via automation and orchestration.
What makes these phishing emails so dangerous to an organization? Small Business Trends reported on the top 10 phishing attacks hitting small businesses this year, and along with the spam meant to spread malware or scam personal or financial information, at least two involved ransomware attacks. An AppRiver report found that 23 million pieces of spam were sent in a 24-hour period specifically to spread Locky ransomware. As eSecurity Planet reported:
The researchers called it “one of the largest malware campaigns that we have seen in the latter half of 2017.”
I would rather not have to write so much about phishing, as there are so many other areas of security to cover. But employees fall for phishing. Phishing is a main culprit for so many security problems. As long as it remains such a huge threat to data and network security, I’ll be talking about it.
Sue Marquette Poremba has been writing about network security since 2008. In addition to her coverage of security issues for IT Business Edge, her security articles have been published at various sites such as Forbes, Midsize Insider and Tom’s Guide. You can reach Sue via Twitter: @sueporemba
