We have all received an email with a catchy subject line that piques our curiosity. You click on it, either because you’re curious or you assume the sender is trustworthy. Unfortunately, this is how most cyberattacks start – with a single click. What can happen next has the potential of putting the security of your business in danger.
Whether you clicked on a link or the unsubscribe button in the email, you may have opened the floodgates to the possibility of single or multiple cyberattacks that could hold your business hostage. According to ProofPoint’s Human Factor 2019 report, more than 99 percent of cyberattacks require human interaction to succeed. That’s why email security should be at the very top of your business’ priority.
It is important to understand how cybercriminals use emails as their weapon of choice, the top cyberthreats your employees are facing every day, and how you can launch a robust counterattack of your own.
The Sophistication of Deception
There’s more thought out planning behind cyberattacks than most think. Cybercriminals are hitting their targets by deception and making you act irresponsibly. In the midst of the COVID chaos, cybercriminals are more consistent and successful than ever before.
They are constantly developing and deploying sophisticated social engineering tactics to fool unassuming recipients. “They quickly adapt and keep the number of targeted users low. This makes it really hard to detect,” explained Elie Bursztein, (Leader Google’s anti-abuse research team), from observations of how attackers have been updating their tactics to make them more efficient.
Regarding phishing emails alone, Google reported that 68 percent of phishing emails blocked by Gmail were new variations that were never seen before.
Cybercrime is constantly evolving to meet technological advances. Being overconfident about your defenses or being underprepared is not a viable stance anymore. It’s time to adopt a proactive approach rather than a reactive one to counter this deception.
Top Cyber Threats that Infiltrate Your Inbox
Phishing involves hackers deploying various social engineering tactics to tempt users into clicking on malicious links and unknowingly giving up confidential information, such as user credentials. Hackers invest a tremendous amount of effort into assuming the identity of a trusted source, making sure that it is YOU who lets them into the system. Once they’re in, they can either install malware on your network’s systems, access and misuse sensitive data, or simply lock your systems and demand a hefty ransom.
Data suggests that this menace is only growing stronger. Verizon’s 2020 Data Breach Investigation Report stated that 22 percent of all breaches in 2020 involved phishing. The fact that even well-informed users fall victim to such attacks adds to this ever growing threat. In a study conducted by BullPhish ID, it was observed that 18.6 percent of users that clicked on simulated phishing campaigns demonstrated a willingness to submit credentials or requested data. Remember, it only takes 1 entry point.
Business Email Compromise (BEC) and Spear Phishing
In a business email compromise (BEC) scam, the attacker hacks into your business email account to impersonate employees or any of your organization’s leaders with the intention of defrauding your company and its stakeholders into sending money or sharing sensitive information. Spear phishing works in a similar way where an attacker spends more time learning about a target, to trick the user with false identity of a trusted source that the malicious email originated from.
A GreatHorn report stated that BEC attacks ballooned by nearly 100 percent in 2019. To get a good picture of the damage a BEC scam can do to your business, take a minute and think of the massive financial and reputational loss your business would suffer if an attacker impersonates you and carries out fraudulent activities in your name.
Let that sink in as we move on to the next threat.
Taking identity impersonation to the next level, account takeovers exploit your compromised user credentials to target your business’, customers’, and vendors’ financial stability and reputation. Many cybercriminals will access other accounts, such as bank accounts and financial statements, to carry out fraudulent transactions. The 2020 Global Identity and Fraud Report by Experience revealed that 57 percent of enterprises reported higher fraud losses due to account takeovers.
Simply put, the attacker will not just target your business, but utilize it as a gateway to also exploit customers’ and vendors’ data simultaneously.
Malicious Malware and Viruses
Although used interchangeably, malware and viruses are technically different. Malware is considered any type of malicious software, regardless of how it works, whereas, a virus is a specific type of malware that self-replicates after entering other programs. Nonetheless, both create an enormous threat to your business’ IT infrastructure.
CSO Online revealed that 92 percent of all malware is delivered via email and that’s why we’ve included it in our list. As mentioned earlier, all it takes is one click for an attacker to gain access to your network’s systems and install malicious software.
A ransomware attack happens when a hacker infiltrates your network, encrypts your data and demands a financial ransom for the return of that data. Now imagine your business coming to a complete hault until you pay the ransom demanded, assuming they will actually deliver. Depending on the data, hackers will double dip, by also selling your data on the dark web. As good backups have traditioinally combated ransomware, cyber bullies have added new blackmail tactics threatening to expose business data to demand payment. Even if you opt to pay the ransom, you have no guarantees the attackers would provide the means to decrypt and restore data, nor can you be certain the data will not be sold, exposed or targeted for a direct attack at some later date.
Not a pretty picture by any means!
To put this into perspective, in Q2 2020, average ransom demands were pegged at $178,254, which was 60 % higher than in Q1 2020 and a whopping 432% higher than in Q3 2019 ($41,198).
Insider Threats: The Human Element
Insider threats are posed by individuals within your organization or closely related to it, such as current employee, former employees, contractors, vendors and partners. Acting unknowingly or out of malice, they can easily let an attacker into the system, leaving all your sensitive data exposed.
In fact, according to Verizon in their 2020 Data Breach Investigation Report, over one-third of data breaches worldwide involved internal actors. An Egress study revealed that 31 percent of employees have mistakenly sent an email containing sensitive data to the wrong person.
While your confidence in your employees is well-founded and justified, remember, it is only human to make mistakes.
Last but certainly not the least deadly, misconfigurations in your email platform can expose your network to a host of threats. For example, it could allow the sending of emails without authentication, so anyone could impersonate an executive’s email. The havoc that could be created if a cybercriminal exploited this vulnerability and sent out emails impersonating anyone from the company’s executive level could be detrimental. Before you know it, you’d be knee deep in managing a full-blown PR crisis.
It’s Time to Engage All Defenses
A cyberattack takes place almost every 39 seconds (or approximately 2,240 times a day), as per the University of Maryland). Now is the time to be proactive. Contact us today to get your cybersecurity on the right track.
Now is the time to implement preventative solutions for endpoint security and backups, identity and access management, automated phishing defense, Dark Web monitoring and security awareness training. While a 100 percent fail-safe approach to cybersecurity isn’t a reality just yet, we can certainly walk you through a list of best practices that will hold you in good stead for the future.
Let’s talk about them today.