Although the tactics and technologies cybercriminals use have evolved over the past 20 years, phishing and other social engineering attacks are nothing new. Despite the significant amounts of time and money invested in cybersecurity training and awareness, employee carelessness and ignorance remain the most vulnerable parts of the average enterprise’s security posture.
A recent study from security vendor SlashNext found that there has been a 341% increase in phishing attacks in the first half of 2024. If that is not disturbing enough, an alarming proportion of users still fall for phishing attacks — in our experience with phishing simulations, as many as 10% of users among our client companies will still fall victim. Statistics from Verizon show that the median time for users to fall for phishing emails is less than 60 seconds.
Phishing gets more sophisticated
So, what is going on here? There is little doubt that phishing attacks have grown in sophistication over the past few years. Criminals have added smarter techniques to their arsenal, such as ‘spear phishing’ — which targets people with highly convincing and personalised messages — and QR code phishing (quishing), which deceives a recipient into scanning a QR code that redirects them to a bogus website.
Furthermore, while many phishing messages still give themselves away through poor grammar or unnatural-sounding language, criminals have lifted their game. Generative artificial intelligence (AI) tools such as ChatGPT have been a godsend for cybercriminals, enabling them to generate more phishing emails than ever before, while improving the sophistication of their work.
They can, for example, use public data about executives and companies harvested with AI to launch precision attacks on company employees. In addition, Gen AI can help cybercriminals eliminate misspellings and grammar mistakes so that their emails seem like credible copies of communications from a bank or tax authority. Cybercriminals can also use Gen AI to rapidly build convincing landing pages to harvest logins and passwords from people they duped.
With this backdrop and companies taking end user education seriously, one would imagine that employees would be more alert, but the reality is that cybersecurity has become a topic that bores many end users. Not only have they tuned out from the warnings they get from their IT department on an almost daily basis, but they have also started to become tired of the friction that cybersecurity causes in their working lives.
Employees who experience cybersecurity training fatigue become less attentive and vigilant when it comes to identifying potential phishing threats. They are more likely to overlook suspicious indicators or engage with malicious content without critically assessing its legitimacy. As such, cybersecurity training fatigue can weaken an organisation's defences against phishing attacks.
More than a third of users cut security corners
One international study found that 54% of office workers are ignoring important cybersecurity alerts and warnings due to digital communication information overload. Nearly 47% agreed that information overload is inhibiting their ability to identify threats such as phishing emails, while 36% admitted to cutting corners on cybersecurity practices. Shockingly, less than a quarter report being engaged in their cybersecurity training.
Unless every end user is hyper-vigilant, it is only a matter of time before an attacker gets their hands on credentials or tricks someone into downloading a ransomware file. As such, it is essential to combat cybersecurity fatigue and keep users deeply engaged in the importance of security. It is helpful to understand why cybersecurity fatigue sets in, in order to rectify or prevent it.
As the research implies, one of the major issues lies in the sheer amount of information employees need to deal with. In addition to constant cyber threat warnings and frequent cybersecurity training, they may also receive a range of other compliance-related information in their inboxes. As a result, they may feel overwhelmed and start to tune out, or their ability to retain information might be compromised.
For employees who are under pressure to perform every day, cybersecurity training sessions might become an unwelcome chore. That is especially the case when they start to feel that the training is repetitive or that they already know the material. Then there is the effort involved in complying with security procedures, such as remembering long passwords or using multifactor authentication (MFA) every time they sign on.
Part of the answer lies in implementing information best practices such as policies dictating multifactor authentication (MFA) and strong passwords. These first lines of defence will foil most attempted breaches via phishing attacks. Zero-trust architectures, where no device, user or traffic is implicitly trusted, can also help stop attacks in their tracks. Passwordless authentication can reduce friction for end users.
Strengthening the weakest link
Ultimately, humans remain the weakest link. To mitigate this risk, organisations should deliver engaging, targeted training initiatives that address employees' specific needs and foster a culture of continuous learning and improvement. Microsoft's phishing simulation tools can be a helpful way to keep people on their toes, correct behaviour, and understand end user behaviour. Strategies such as gamification, role-based training, micro-learning, and reward programmes are also effective.
We also find that it helps to take a positive slant, focusing on what employees should do rather than what they must not do. This means offering ways for employees to do their jobs and remain productive — clear guidance around the right cybersecurity behaviours and principles. Positive reinforcement works better than a punitive approach, especially when the goal is to get users to report to IT when they see a suspicious message or believe they have fallen for a scam.
Ultimately, the objective is to create an environment where every employee understands the importance of addressing cyberthreats and commits to playing their part. With the right technology and an engaged, vigilant workforce, enterprises can be optimistic about their odds of success, but it requires an environment where people feel rewarded for constantly learning and adapting.
For more information, go to https://www.plusonex.com
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version