Attackers Evolve
A good hacker is like any good professional in that they never stop learning. While it may seem odd to attribute this characteristic to a thief, a motivated cybercriminal will find ways to get around security blocks that were specifically intended for them.
They might buy new devices or install new software. They might brainstorm creative ways to make an employee believe that they’ve just gotten an email from their boss or a message from an old classmate on social media.
This is the number one reason why you need ongoing training. The tips and tricks that worked last year might become obsolete by next year (or even six months from now). There are dozens of techniques that phishers rely on, and each tactic will become more sophisticated as the years roll by. Ongoing training will give employees the information they need to identify the threat before it ever has a chance to manifest into a security breach.
Employees Are Busy
An employee who has dozens of things on their to-do list is simply not going to have the mental capacity to double-check their actions. If they get an email from their coworker, they’re going to open it. If they see a link, they’re liable to click on it. This is what phisher absolutely count on when they’re devising their techniques.
Ongoing training won’t make an employee any less busy, but it can instill the importance of defending themselves against hackers. The goal of training is to make an employee so aware of the problem that spotting scams become second nature to them. This way, deleting the email from their fake boss is not different than deleting any other piece of spam.
People Respond to Language
Cybercriminals know how to get people interested in what they have to say, which is why they may make anything from positive promises to negative threats in their subject line. Informing the recipient that their credit card will be suspended or they might be evicted from their home are both sure-fire ways to get a recipient to respond.
They may even have more specific information, such as the employee’s position within the hierarchy of the company. In one notorious scam, hackers posed as HR administrators. They sent emails to employees asking them to update their payroll information, a request that caused the employees to lose their paychecks entirely.
Baiting Techniques Work
Phishing doesn’t only mean sending emails or messages to employees. Baiting techniques have proved particularly effective, largely because it begins with a believable premise. With a baiting technique, a hacker might install malware onto a flash drive, and then casually leave that flash drive stuck between the cushions of a couch in an office lobby.
As soon as someone finds the flash drive, they might assume that one of their colleagues left it there. To figure out who it belongs to, they’ll plug it into their computer without realizing what they’ve actually done. A criminal might leave drives anywhere they think someone will find them — including bathrooms, parking lots, or work stations. A trained employee will be much more likely to take an unknown device to an IT professional who can determine whether it’s safe to use.
The Links Look Real
Every year, hackers see who responds to the information they send out. They take the most successful attempts and then adapt them to how employees work on a daily basis. Criminals know that internet users have become savvier in much the same way that they have.
It’s why phishing has changed so much from where it began. The grammar is better, the graphics are professional, and even the logos and trademarks look entirely legitimate. If an employee gets a phishing email, they’re not always going to see that the link reads amazon.co instead of amazon.com. (If you’re using sandboxing protection, you should know that this will scan attachments, but it won’t scan for links.) All it takes is one idle click of a mouse to open a whole world of trouble.
You Can't Always Control the Environment
It might be relatively easy to control for phishing within an organization without the help of training. From firewalls to encryption, many owners rest easy knowing they’ve put countless protections in place to give hackers a reason to move on.
But what happens when an employee is working from home? Or they have to travel to a different country? Or they have to connect to a vendor’s internet in order to complete a transaction? These protections can quickly fall apart outside of a company’s four walls. Without the right education, an employee could easily fall prey to a phisher.
What You Can Do
Cybersecurity isn’t just identifying phishing tactics. From password security to physical safety, there’s a lot for employees to know. And make no mistake: it’s far more cost-effective to get employees training than to expose your company to malware.
Experts recommend yearly training at the bare minimum. This will not only help employees understand how hackers have changed from one year to the next, but it also sends a clear message that cybersecurity is a priority for the company.
