Wondering why there are so many security holes in your network, or how some of your employees seem to always report broken computers? Well, it turns out that one third of employees are likely to fall victim to phishing attacks. Yes, that’s right, in 2016 around a third of workers are still foolish enough to click on a dodgy link and risk their company’s entire network security in the process.
The figures come from a free tool launched in March by Duo Security to test network security. IT teams at 400 companies put 11,542 employees to the test by sending out “phishing emails” to see who would fall for the trick. Of those recipients, 31% opened the link contained in the email – behaviour that, were it a real phishing email rather than a dummy one, could cause a data breach at the company they work for.
The fact that only a minority fell for the “scam”, with two-thirds of those tested recognising the link as potentially malicious, isn’t the point, according to Jordan Wright, R&D engineer at Duo Security.
“Just one malicious email is needed for an attack to be successful.”
“At the end of the day, what we see is that just one malicious email is needed for an attack to be successful,” Wright told IT Pro. “31% may seem low, but in reality, it is still a lot of people.” Indeed, in the case of these results, 31% is 3,578 people – an average of nearly nine per business.
Creating a phishing scam
Duo Security’s Duo Insight tool was used by the 400 companies to send out the fake phishing email to their employees.
“We encourage IT administrators to customise the email as much as possible,” said Wright, mimicking the targeted attacks often levied at businesses by hackers. This increases the likelihood that a recipient will open the email and click through.
“People think that if they don’t enter their details, they are safe, but exploit kits can still download onto the computer without the user entering any information.”
That isn’t the end of the scam, though. If the landing page then asks for credentials, users may smell a rat and decide to click away, rather than handing over their details. But, while users may think no harm will come to them if they haven’t fallen for step two, that may not be the case in reality.
“This is a really big part of security,” said Wright. “People think that if they don’t enter their details, they are safe, but exploit kits can still download onto the computer without the user entering any information.”
The point of this exercise isn’t to catch people out or make them feel bad, though.
“The intent is for administrators to do two things. Firstly, to work out their strategies for dealing with potential phishing attacks and secondly to help educate the users,” Wright said. This is more than just teaching them not to blindly click on links, but also, for the 59% who do not click, to encourage them to report an incident to IT, helping to nip it in the bud.
If you’re curious to put your own company to the test, you can download a beta version of Duo Insight for free.
Image: Alan Kotok – Flickr
Disclaimer: Some pages on this site may include an affiliate link. This does not effect our editorial in any way.
