Phishing attacks are the most common cause for data theft, so the goal of this article is to teach you some self-defense strategies. Just like in martial arts, the key to self-defense relies on two factors: 

• know the enemy: raise cyber security awareness in your company
• know yourself: identify access risk in your company and check your security status

We will go through these two crucial elements to make sure your company won’t be on the hook!

Know the enemy: What is a phishing attack?

Phishing attacks are the practice of sending fraudulent communications, usually emails, that appear to come from a trustful source, requesting sensitive data such as login credentials. The highly customized, believable message is the bait, the employee or the CEO is the fish, and their unawareness is the hook that caters the external attackers with the big catch: confidential business data.

Suspicious links and attachments, urgent, threatening language and a request to perform an action: these are the general characteristics of a phishing attack to deceive the victim, but there are many other tricks at the attackers’ disposal.

Most common types of phishing attacks

There are several types of phishing attacks, we can group them into main categories based on: 

• who is targeted: the size of the fish (level of privileged access)
• how they’re targeted: what is the catch? (tricks to deceive the victim)
• where they’re targeted: what is the platform? (email, voice message, etc)

Let’s see some examples:

Whaling – Target the big fish: When attackers go after a CEO, it’s called whaling, because of their privileged access to sensitive information. Attackers often spend considerable time profiling the target to find the best way to hunt them down.

Spear phishing – Target with precision: Spear phishing emails are targeted at specific companies or groups of people. Attackers customize these fraudulent messages with the target audience in mind such as HR communication with custom domain name, so they’re highly believable and likely to get the victims to click on the links.

CEO Fraud – Target with authority: Similar to spear phishing, the catch is not only customization, but fear from authority, such as urgent emails from the CEO who needs immediate help from an employee. 

Smishing and vishing – Target via SMS and phone calls: the sender’s or the caller’s perceived authority, as a partner firm, vendor or supplier, convinces the victim to perform the action requested by the criminal

Phishing attack in statistics

Numbers are more impressive than dry definitions so let’s go through some recent stats to describe the gravity of phishing attacks.

Roughly 90% of data breaches occur on account of phishing – an external attack that could have been easily warded off with proper access risk management. More than 83% of organizations were affected in 2021 and according to the US Federal Bureau of Investigation, phishing attacks may increase by as much as 400% year-over-year. 

Hard time for SMBs

Accenture’s Cost of Cybercrime Study states that 43% of cyber attacks are aimed at SMBs, but only 14% are prepared to defend themselves, and what is even worse 83% of small and medium-sized businesses are not financially prepared to recover from a cyber attack.

Whether we talk about the corporate level or the SMB sector, cyber criminals can penetrate 93% of company networks. The question is: do you want to belong to the remaining 7%? 

Download our checklist to see how to strengthen your defense 

Causes and consequences of phishing attacks

Now that we know the definitions and the numbers, it’s time to see the causes and consequences. 

When the phishing attack results in substantial data breach, the cause is almost always the same: human error and access risk. More specifically:

An employee unaware of the phishing attack with too many access rights. 

When there are too many employees like this in your company, the more exposed you are to phishing attacks. It takes just one click and that’s the point of no return: the consequences are far-reaching. Other cyber security threats and cybercrime attacks such as advanced persistent threats (APTs) and ransomware often start with phishing.

So cyber security training and strict access control management should go hand in hand: that’s the only way to mitigate the impact of phishing attacks. 

Cyber security training alone is not enough!

You can teach your employees how to recognize a phishing email and what to do when they receive one. Simulation exercises are also crucial to test how your employees react to a staged phishing attack. But, it’s not enough to know your enemy: you need firm control over your employees’ access rights.

Know your security status: do you trust your employees?  

Your employees are the bloodlife of your company, your workforce builds your corporate identity. They are the gates where profit, success can flood in but also the reason for a wide range of cyber attacks. 

Do you really know your employees? Do you know their exact level of cyber security awareness? Do you know what each employee has access to? Do you know their license usage? If you don’t know them, how can you trust them? It’s not about malicious employees, it’s about unawareness and human error: we all know, the road to hell is paved with good intentions. 

Employee fluctuation is a challenge in itself, so it’s just beyond human capacity to track employee actions. That’s why access risk management best practices are so important to strengthen your security status.

Check your current security status

Access risk management can make or break your business

Each business manages access risk to some extent, but the big question is: How? Segregation of duties or least privilege principle are the most common best practices followed by organizations.

Separation of duties, also known as segregation of duties, is an administrative control used by organizations to prevent fraud, data theft and misuse of information. It relies on the concept of having more than one person required to complete a task, so nobody has unlimited access rights to confidential resources within the organization’s ecosystem. 

However, despite its role to improve security, breaking tasks down into separate components can negatively impact business efficiency so SoD is usually applied to the most vulnerable elements of the business.

Least privilege principle or the principle of least privilege (PoLP) refers to the cyber security practice where a user is given the minimum levels of access needed to perform his/her job functions. 

It is a fundamental step in protecting privileged access to high-value data and assets.  However, to perform certain tasks, privileges are often re-granted and they are rarely supervised or revoked, and over time, this “privilege creep” reopens the security loophole associated with excessive access rights and makes organizations – that likely believe they are well-protected – more vulnerable to threats.

So human error persists, that’s why companies need cyber security tools to minimize it and use automated processes where possible!

Effortless defense: automated access control

Segregation of duties, internal house rules, following the principle of least privilege or regular cyber security training still leave an open door for human error and external threats such as phishing attacks.

The most efficient and effortless defense is to minimize human error and automate access control management. Our software, TheFence, helps you to strengthen your security in the most effective way.

• Automated risk detection: Identify potential risk factors without relying on manual tasks or time-consuming training. It minimizes human error, the most common cause for business data leakage. There’s a vigilant eye that never sleeps to watch over your company!
• Automated notifications and alerts: Prevent suspicious activities from turning into security threats. Reaction time is crucial, it can make a difference between an access risk and a cyber attack. Automated alerts help you address potential access risk issues as soon as possible.
• Maximize transparency in your company: Notifications and alerts are sent directly to your company’s communication channels, so there’s maximum awareness, nothing blocks the flow of information. Stay always up-to-date and get a detailed overview of your employees’ security status.
• Pass any security audit: Auditors can cause constant stomach cramps, especially if you work in an industry where you have to be compliant with IT security standards. Be prepared instead of being scared. 

It’s not just about security: it’s cost-efficiency!

By monitoring employee status and license usage you can save money by revoking unassigned licenses. You’ll get a report of potential annual license cost savings. See it for yourself!

Check what you can save with automated access control

Defend what’s yours

Stay safe, stay ahead of cyber threats. TheFence is a cloud based cyber security software that maximizes your defense with automated access control. Secure your inner circle, empower your workforce and defend what’s yours from phishing attacks!