OCTOBER 2021 • LONGISLANDPRESS.COM 25
TECH INSIGHTS
GONE PHISHING: WHY SECURE EMAIL IS NOT ENOUGH
Protecting your business
from cyber attacks starts with
training your own staff on how
to spot a threat.
We spoke to Custom Computer
Specialists Vice President
Tom Franson, who shared his
insights on how to mitigate this
growing threat.
What is the number one
threat organizations need
to be worried about? Hands
down, email is the number one
threat, closely followed by webbased
attacks. We’re currently
looking at email malware
infections impacting 67% of
organizations and web-based
attacks in second place at 63%.
What are the different types
of email-based attacks? The
top four are phishing emails,
which is when an email is sent
to a large number of users
simultaneously and attempts
to “fish” sensitive information.
Then there’s spear-phishing,
which is more targeted and
usually contains information
that is specific to a group.
Executive whaling is one of
the newer tactics being used
by cybercriminals as they go
after C-level executives who are
more likely to click, since they
usually receive so many emails
they don’t have time to review
and analyze each email. Finally,
there’s CEO fraud, which is
when a CEO’s email get spoofed
while she/he is travelling and
asks employees to transfer
large amounts of money out of
the country.
What is the best way to defend
against these attacks? We’ve
found that passive security
practices, such as setting up
firewalls, don’t work against
highly aggressive threat
sources. This doesn’t mean
that traditional defenses won’t
work. They all play a part and
make it harder for the bad
guys to succeed; they’re just
not enough. The first line of
defense should be the users
themselves.
In essence, you’re talking
about a human firewall?
Exactly. For example, a study
was done with 100 engineering
and science majors, and one
in six fell victim to obvious
phishing scams. Another
showed that 96% of executives
failed to tell the difference
between a real email and a
phishing email. The best way
to mold employees into human
firewalls is with security
awareness training.
How does security awareness
training work? It’s important
to identify a training program
that educates and informs
employees to make them phishsavvy.
The best programs are
comprehensive. It’s important
to find a program that not only
provides security awareness
training, but also coordinates
that training with simulated
phishing attacks. Of course,
to determine the effectiveness
of any program we encourage
organizations to baseline how
susceptible their employees are
to phishing attacks.
I’ve heard sometimes these
simulated attacks go awry
when employees tell each other
about the “internal phishing”
they just received. That’s so
true. We find the best way
to avoid this is to ensure the
Getty Images
simulated phishing attacks are
random, meaning the emails
are sent to random groups, at
random times using random
phishing templates.
Is there any other advice
you can give organizations?
Build a human firewall and just
remember to keep in mind that
hackers only need to get lucky
once, but security systems have
to win every time. If anyone
has any questions about their
security defenses I’d be happy
to jump on a call.
Custom Computer Specialists
is proud to sponsor Tech
Insights. Since 1979, Custom
has been dedicated to providing
Long Island’s schools, local
government agencies, healthcare
facilities, and businesses with
advanced technology solutions
and support. To learn more
about Custom Computer, please
email info@customtech.com
CYBERSECURITY
Success Begins Here.
Get Started Today!
(800) 598-8989
info@customonline.com
/LONGISLANDPRESS.COM
link
link
link
link
