Hybrid Workforces Face Unique Phishing Challenges
Two years into the COVID-19 pandemic, organizations are continuing to face evolving, unique challenges in how they defend against phishing attacks, including workforces that rely on a tangle of different devices, disparate work landscapes and cybercriminals that are “as adept as ever.”
These factors all add up to a lucrative target environment for phishing attacks, which researchers with Proofpoint said went up across the board over the past year. The report revealed that indiscriminate “bulk” phishing attacks increased 12 percent in 2021 over the previous year, while more targeted attacks like spear phishing and business email compromise were also up year-over-year, 20 percent and 18 percent, respectively.
“Along with hybrid and remote work options, organizations are mulling the best ways to keep employees connected and collaborative,” said researchers with Proofpoint in their 2022 State of the Phish report, released Tuesday. “Studies show the ongoing pandemic has had a major impact on workers’ mental health. Employees are feeling burned out, emotionally drained and distracted. Meanwhile, cyber attackers are as adept as ever. And they continue to use tactics and lures that resonate with employees and consumers alike.”
The annual report, which explores issues driven by poor cybersecurity practices and the impact of a lack of knowledge and communication around phishing threats, draws data from 3,500 working adults, as well as 600 IT security professionals, across seven countries. The report also looks at almost 100 million simulated phishing attacks and 15 million emails reported by end users.
Researchers saw a “marked increase” in the abuse of Microsoft and Google infrastructures, with attackers leveraging Microsoft 365 (that includes Office apps, OneDrive and SharePoint), Microsoft Azure, Google Workspace and Firebase Storage. Beyond that, researchers also found that employee recognition of common cybersecurity terminology had decreased in 2021 from the previous year, causing concerns about how professionals are being trained when it comes to cybersecurity threats. For instance, the number of employees that correctly knew the definition of phishing (53 percent) was down 16 percent year-over-year. At the same time, more than two-thirds of respondents demonstrated a lack of understanding about the capabilities of technical email safeguards on work accounts.
“The overall decline in awareness is another area where pandemic fatigue – and its impact on workers’ engagement and attention spans – could be a factor,” said researchers. “It could also reflect a decreased prioritization of cybersecurity awareness and training initiatives during 2021. The pandemic has put many different pressures on organizations, and some may have been forced (due to lack of time, resources or other factors) to deprioritize employee education programs.”
New-school security awareness training can enable your employees to thwart both sophisticated and rudimentary phishing attacks.
With thanks to the Cyber Defence Alliance and Proofpoint. The full story is here: https://duo.com/decipher/hybrid-workforces-face-unique-phishing-challenges
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW