Make sure to add us or contact us for the latest news
 |
 |
 |
 |
 |
 |
 |
Ten Important Facts about Social Engineering – Get the Facts About Social Engineering to Fight Back Against this Threat
The art and science of manipulating human behavior is called social engineering. In a social engineering scenario, the goal is to get the target to take some sort of action, from buying a ticket to starting a new diet. For example, all advertisements are a form of social engineering. Advertisers have the goal of enticing their targets, consumers into buying their products, like a certain brand of cereal. Sometimes, this technique can be used for good purposes, like encouraging people to recycle. But cybercriminals aren’t so altruistic. They use social engineering to entice their victims into taking an action that harms their company’s security and helps the bad guys accomplish their goals – and in a year of record cybercrime, they’re having historic success. Get the facts about social engineering to really understand how to stop them from successfully pulling one of their schemes on your business.
How Does Social Engineering Relate to Cybersecurity?
The vast majority of cybercrimes contain an element of social engineering. That’s what makes these schemes hard to spot and hard to resist. Cybercriminals want to evoke a feeling in you that will spur you on to take an action, and the clever ones are extremely clever. There are really two main feelings that they prey on: fear and trust. Bad actors need to entice their target into clicking their link or downloading their attachment, so they use tricks like spoofing to trick you into buying into their lies by impersonating trustworthy sources. They’ll also capitalize on chaos and uncertainty. that’s a big reason for 2020’s massive cybercrime boom – a wealth of targets who were disconcerted, frightened and stressed created a target-rich environment.
Cybercriminals have grown increasingly more sophisticated in designing and delivering their bait, utilizing extensive dark web resources to create tailor-made spear phishing lures for their prospective victims. Social engineering scams that employ spear phishing can be as simple as a bogus email from a store asking you to change your online account password and as complex as mimicking an executive’s identity believably. It’s also a tried-and-true way of tricking victims into downloading ransomware. It’s quick, easy, and profitable – socially engineered ransomware attacks are already up 40% year-over-year, and that’s comparing 2021 to 2020’s record-breaking cybercrime numbers. Scams like these will only become more influential in the future as the pool of information available to bad actors grows on the dark web. In 2020 alone, 22 billion more records were added.
These are a few examples of social engineering as it relates to cybersecurity:
- Luring a victim to a fake website to “update their password” when they’re really handing it over to cybercriminals.
- Convincing victims to download a document outlining a new company policy that’s actually a ransomware bomb.
- Coaxing a victim into sending bad actors sensitive information by pretending to be an executive at the target organization
Plus, cybercriminals aren’t the only people doing the social engineering in many cases, nor are they providing the only influences. Cybersecurity culture, company policy, fear, stress, exhaustion – all of these factors combined can engender circumstances that can cause employees to take certain actions around cybersecurity.
10 Facts About Social Engineering That Illustrate the Seriousness of This Risk
Take a look at these statistics to see the real picture of this threat.
- 98% of cyberattacks rely on social engineering.
- 43% of IT professionals say they have been targeted by social engineering in the last year.
- 45% of employees click emails they consider to be suspicious “just in case it’s important.”
- 47% of employees cited distraction as the main factor in their failure to spot phishing attempts
- On average, social engineering attacks cost $130,000
- The number one type of social engineering attack is phishing.
- IC3 reports that socially engineered business email compromise is the costliest cybercrime.
- Socially engineered cyberattacks are just under 80% effective.
- An estimated 70 – 90 % of breaches are caused by social engineering.
- 45% of employees don’t report suspicious messages out of fear of getting in trouble
Are your systems and data in cybercriminal sights? Our Cybersecurity Risk Protection Checklist will help you find and fix vulnerabilities. GET IT>>
Try Some Social Engineering of Your Own
Creating a healthy cybersecurity culture is essential for defending businesses from the consequences of cybercriminal social engineering. By making cybersecurity a priority and training everyone to recognize threats, you’re making every employee feel like they’re part of the security team too. That’s what makes phishing resistance training so vital. If just one employee spots and stops a phishing email because they’re invested in maintaining a strong defense, that can save a company millions of dollars as well as uncountable headaches in recovering from a cyberattack.
Why wait until there’s trouble? Contact the experts on our team today to learn more about how our solutions can protect your business from cybercrime.
Dark Web ID’s Top Threats This Week
United States – Three Affiliated Tribes
Exploit: Ransomware
Three Affiliated Tribes: Tribal Government Organization
Risk to Business: 1.607= Severe
The Three Affiliated Tribes (the Mandan, Hidatsa & Arikara Nations) announced to its staff and employees that its server was infected with ransomware. Since the server was hacked, the tribe has been unable to access files, email and critical information. Employees were also asked to refrain from using their work computers, Investigation and recovery is ongoing
Individual Impact: At this time, no sensitive personal or financial information was confirmed as compromised in this incident, but the investigation is ongoing.
Customers Impacted: Unknown
How It Could Affect Your Business: Protection from ransomware needs to be a top priority for every organization. These days a new attack is launched every 40 seconds putting every business in the line of fire.
IntegraMSP to the Rescue: Make sure that you and your clients are making all the right moves with our Cybersecurity Risk Protection Checklist. GET THE CHECKLIST>>
United States – US Veterans Administration (VA)
https://threatpost.com/veterans-medical-records-ransomware/166025/
Exploit: Ransomware
Veterans Administration: Federal Agency
Risk to Business: 1.612= Severe
The VA has found itself in the cybersecurity hot seat again after a data breach at a records contractor exposed more than 200,000 records for veterans. The contractor, United Valor Solutions, appears to have been the victim of a ransomware attack. Researchers found a trove of their data online, including this sensitive VA data. The VA has announced that its Veterans Benefits Administration (VBA) Privacy Office is currently working with Medical Disability Examination Officer (MDEO) and contractors to further handle the incident, with the VA Data Breach Response Service investigating independently.
Individual Risk: 1.722= Severe
The exposed records contain included patient names, birth dates, medical information, contact information and even doctor information and appointment times, unencrypted passwords and billing details for veterans and their families, all of which could be used in socially engineered spear phishing or fraud scams.
Customers Impacted: 200,000
How it Could Affect Your Business Ransomware is the gift that keeps on giving for medical sector targets. Not only are those victims facing expensive investigation and recovery costs, but they can also expect a substantial HIPAA fine and possibly more regulatory scrutiny.
IntegraMSP to the Rescue: Get expert advice to minimize damage from incidents like this in our ebook Breaking Up with Third Party and Supply Chain Risk. GET THE BOOK>>
Don’t let cybercriminals put the brakes on your race to success. Boost your cyber resilience to keep your engine running in any conditions. LEARN MORE>>
Ireland – Health Service Executive (HSE) (included this week because of the sheer mass of it)
https://www.bbc.com/news/world-europe-57134916
Exploit: Ransomware
Health Service Executive (HSE): National Healthcare Provider
Risk to Business: 1.568 = Severe
Ransomware rocked Ireland after the Conti gang perpetrated attacks on both the Department of Health and Ireland’s national healthcare provider Health Service Executive (HSE). HSE was forced to take action including shutting down the majority of its systems including all national and local systems involved in all core services and all major hospitals. The ransom demand is reported to be $20 million. The National Cyber Security Centre (NCSC) has said the HSE became aware of a significant ransomware attack on some of its systems in the early hours of Friday morning and the NCSC was informed of the issue and immediately activated its crisis response plan. On Monday, May 18, officials announced that diagnostic services were still impacted as well as other patient care necessities. Officials alos said that it may take the Irish health service weeks to repair systems and restore all services, at a price that will reach into the tens of millions of euros.
Individual Impact: No sensitive personal or financial information was confirmed as compromised in this incident, but the investigation is ongoing.
Customers Impacted: Unknown
How it Could Affect Your Business: Ransomware is the preferred weapon of cybercriminals at every activity level. Increased security awareness training makes organizations up to 70% less likely to experience damaging cybersecurity incidents like this one.
IntegraMSP to the Rescue: BullPhish ID provides customizable security awareness training including phishing resistance that enables MSPs to conduct training on industry-specific threats. CONTACT US>>
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk
Risk scores for The Week in Breach are calculated using a formula that considers a wide range of factors related to the assessed breach.