Government Workers as Phishing Targets
Government workers are prime targets for social engineering attacks, according to Kaitlyn Levinson at GCN. Attackers use different tactics to target government employees in specific roles. Levinson quotes Rita Reynolds, Chief Information Officer for the National Association of Counties, as saying that customer-facing county employees might be more likely to assume that requests are legitimate, since they deal with so many people each day.
“Hackers prey upon the customer service aspect of county employees,” Reynolds said. “That desire to be prompt and successful in filling the request can oftentimes result in a county employee maybe not paying closer attention to the authenticity of the email.”
Reynolds added that county agencies should implement security best practices outlined by the Cybersecurity and Infrastructure Security Agency (CISA).
Levinson writes, “CISA advises organizations to use phishing-resistant multi-factor authentication, which goes beyond security measures such as one-time passwords and uses FIDO/WebAuthn authentication or PKI-based MFA, to close the gaps that bad actors could squeeze through.”
Arun Vishwanath, Chief Technology Officer of Avant Research Group, explained that even technical employees are vulnerable to phishing attacks. IT employees may become complacent and assume they’ll be able to recognize phishing emails.
Meredith Ward, director of policy and research for the National Association of State Chief Information Officers, told GCN that government organizations should ensure that their employees are aware of these types of attacks.
“The reality is that there is no one protection tool or technology that can prevent or respond to every cyberattack,” Ward said. “The human factor plays a large part in this discussion, and human awareness is but one tool states have to thwart cyberattacks.”
New-school security awareness training can give your organization an essential layer of defense by teaching your employees how to recognize social engineering attacks.
GCN has the story.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW