As more and more businesses move or expand from bricks to clicks, criminals are following suit. Many e-commerce websites are directly connected to the internet as well as to a company’s back-end systems for data processing and supply management, making the website a prime target for gaining access to critical information assets within the organisation.
Cyber-attacks are becoming more sophisticated and advanced. International reports indicate that attacks on intellectual property and other proprietary information held by businesses, as well as individuals, are becoming more common. Many attackers are coordinated, well-funded, and investing heavily in new ways to exploit the digital environment.
A global software company based in New Zealand recently released its phishing simulator tool, which is intended to help organisations improve their cybersecurity awareness. With the increase in phishing campaigns over the last year, employees must be able to identify an attack and know what to do if they see one.
As per the software company, the simulator allows organisations to evaluate the effectiveness of their cybersecurity education by diagnosing vulnerabilities and identifying critical skill gaps using realistic phishing simulations. The new tool can simply be used to determine how vulnerable an organisation is to phishing attacks. However, it can also be combined with additional training.
Furthermore, the simulator allows users to select from a curated selection of phishing email templates or create new templates for their campaign, as well as fully customise the software based on their brand and needs. Users can practise targeted spear-phishing attacks by clicking on malicious URLs that request personal information and passwords.
The tool is delivered through the cloud-based platform, making it easier for businesses to deploy refresher courses to employees who fail the phishing simulation.
“Regardless of size, every organisation is under threat of phishing attacks, and with the headlines constantly announcing the latest breach, it’s high time cybersecurity awareness training became a priority for all employees,” says the company’s managing director.
He also stated that it only takes one click on a malicious link to expose an organisation to a cyberattack. By simulating an attack, the organisation can assess the resilience of its employees and quickly deploy targeted training to those who require it. This can build organisational resilience to cybersecurity risks and can continually be assessed and measured through multiple campaigns.
During a crisis, people are on edge. They want information and are looking for direction from their employers, the government, and other relevant authorities. An email that appears to be from one of these entities and promises new information or instructs recipients to complete a task quickly will likely receive less scrutiny than prior to the crisis. An impulsive click later, and the victim’s device is infected or the account is compromised.
A report found that nearly 500 vulnerable Microsoft Exchange email servers and more than 100 compromised email servers between the beginning of January and the end of March. The majority of the compromised mail servers belonged to small businesses, but a few large corporations were also hit. Phishing and credential harvesting remained the most reported incident category, followed by scams and fraud, then malware.
“With impersonation phishing attacks becoming increasingly common, we will additionally be working closely with our users to create highly personalised templates designed to test the vulnerability of their employees,” commented the software company’s CTO.
Users of the phishing simulator can automatically enrol participants who failed the phishing test in any courses offered through the cloud-based platform, as well as access other company policy documents and e-learning. Business leaders can measure the effectiveness of the testing by tracking in real-time how employees have reacted to the fake phishing email, allowing security, compliance, and HR teams to understand where to provide additional support to mitigate risk and reduce susceptibility to future attacks.
