Phishing and Pretexting Dominate Social Engineering-Related Data Breaches
New data shows that despite the massive evolution of the cybercrime economy, threat actors are sticking with the basics in social engineering attacks, with a goal at stealing data.
I probably could have called this purely based on all the articles I’ve written (and all the articles I’ve read that never made it here). But when it comes to protecting your organization from social engineering, stick to the basics.
According to the latest Verizon Data Breach Investigations Report, data breaches that rely on social engineering use three basic methods – pretexting, phishing and extortion, as shown below:
Source: Verizon
All three methods rely on establishing credibility with the victim enough to get the victim to respond. Pretexting is the most rudimentary social engineering where the attacker attempts to get the victim to trust them and, eventually, share information. It’s the precursor to other attack types and is used to gain intelligence that will be leveraged in a future threat action.
And because there’s no malicious links or attachments, there’s little means to detect it as being risky to the organization. That’s probably why we see it in the number one spot, represented in just over 40% of social engineering-based data breaches.
The use of pretexting also speaks to the need to educate users about such “attacks” (which won’t feel like an attack at all, but more a reaching out and establishing content) through security awareness training designed to elevate a users sense of vigilance such that, even when an email appears benign in nature, there’s still a default level of disbelief and scrutiny, helping to lower the risk of an attack.
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW