Social engineering a factor in virtually all cyber attacks, report claims

guest · Sep 9, 2019

Social engineering a factor in virtually all cyber attacks, report claims
September 9, 2019
https://www.computerweekly.com/news...-in-virtually-all-cyber-attacks-report-claims

The exploitation of human failings to attack enterprises using so-called social engineering attacks through cloud applications, email or social media, is a factor in up to 99% of cyber attacks, according to Proofpoint’s latest annual Human factor report.

“Sending fraudulent emails, stealing credentials and uploading malicious attachments to cloud applications is easier and far more profitable than creating an expensive, time-consuming exploit that has a high probability of failure,” said Kevin Epstein, vice-president of threat operations at Proofpoint.
Proofpoint highlighted the existence of what it terms “very attacked people”, or VAP, as the most often approached targets. These individuals tend to be located deep within a target organisation, to have access to either funds or sensitive data, and, crucially, to have identities that can be gleaned via corporate websites, social media, trade publications, or even Google searches.

Threat actors are also refining their tools and techniques, moving from one-to-one and one-to-many attacks to attacks using multiple – often more than five – identities against more than five individuals in their target organisations.
Click to expand...

Proofpoint: Pervasive Social Engineering Characterizes the Threat Landscape: Proofpoint Releases the Human Factor 2019 Report

guest · Sep 26, 2019

How can we thwart email-based social engineering attacks?
September 26, 2019
https://www.helpnetsecurity.com/2019/09/26/email-based-social-engineering-attacks/

More than 99 percent of cyberattacks rely on human interaction to work, Proofpoint recently shared. More often than not, the principal attack method is phishing emails.

Armorblox CEO Dhananjay Sampath told Help Net Security they’ve also witnessed attackers using a variety of emails, hoping one of them would be able to fool phishing filters and do the trick.
There is no one foolproof solution
All companies should invest in teaching their employees how to spot phishing emails – and many do – but multi-layered defenses are a must because each layer has exploitable holes.

“With the astronomical increase in SaaS apps used by organizations, it is incredibly hard for security teams to look for IoCs within millions of emails. We’ve seen organizations invest in employee training, but social engineering attacks are so sophisticated that it’s difficult for people to recognize them for what they are,” Sampath said.
“Industries with public-facing information about their business transactions and processes can present attractive targets for BEC schemes,” the Financial Crimes Enforcement Network (FinCEN), a division of the US Treasury, has pointed out in an advisory released earlier this year.
Click to expand...

Improving detection technology
Phishing and BEC scams are continuously evolving to evade security tools that organizations have in place, Sampath noted. But an effective analysis of email language, links and attachments should catch most (if not all) email-based social engineering attacks.

“NLP and deep learning can be used to examine the context, sentiment, and tone of emails and analyze the identities of the senders, the recipients, their writing styles, and their normal communications patterns,” Sampath opined.
Click to expand...

Log in or Sign up

Social engineering a factor in virtually all cyber attacks, report claims

guest Guest

guest Guest

Log in or Sign up

Social engineering a factor in virtually all cyber attacks, report claims

guest Guest

guest Guest

Useful Searches