Date: 08 October 2018
Author: Steve Burnside
Staying Secure in A Facebook Hoax World
NETWORK SECURITY = RISK MITIGATION + RISK ACCEPTANCE
You'll never be 100% secure. The key is understanding the risk you are accepting.
The new Facebook “evil doppelgänger” viral hoax is proof many people still don’t fully understand how phishing attacks operate, infiltrate and spread.
If you're curious how vulnerable your network is, you only need look as far as your Facebook feed. As reported by the Washington Post, Facebook users are being inundated posts from friends, acquaintances, family members and high school classmates instructing their connections not to accept a second friend request from them, or worse - forwarding the initial message that starts “Hi… I actually got another friend request from you”. People are following instructions and forwarding the same message on, without verifying if there is even a cloned account in their name. There is no hack. There is no double-account evil villain.
This perpetuates the cycle. The willingness to accept unverified information from a trusted source, and then act on that information, just proves that so many in the public have no idea how phishing scams and hacking attempts actually work.
According to the https://www.phishing.org/ over 100+ billion phishing emails are sent each day and 85% of organizations have already been targeted in an phishing attack. With phishing attacks on the rise, we only need look to personal "risky security behavior" for an indication of behavior in the workplace. If a person is susceptible to a hoax on a social media platform like Facebook, chances are that person will exhibit the same behaviors in the work environment too, putting the company at risk. With phishing scams costing American business an estimated $500 million in 2017, organizations must understand the importance of both the acceptance of risk and risk mitigation.
What this means is, no amount of security is ever going to be enough to keep a person from letting an attack in the front door. You may have deployed technology to cover the full threat spectrum; but if an employee circumvents those measures, your network may be at risk. So, how does leadership minimize this threat? How do you keep employees from walking the evildoers in through the front door, but not hamper productivity?
Here are some of the top ways to prevent being caught up in a phishing attempt:
- Employee Education – for both the threats that are out there, and the approved methods of sharing data with external sources.
- Email Protection – up-to-date spam settings as well as notification when an email is coming from an external source.
- URL Filtering – with attackers moving from domain to domain to prevent static lists from catching them, having a service with dynamic updates can help to keep employees in safe waters.
- Admin Privilege Restriction - Lock down administrative privileges on users’ machines. Part of understanding the risk to the network is controlling what software is running on it.
- Have a fallback plan – does your company have a contact for employees who realize “Whoops, I shouldn’t have clicked that!” and if so, are the employees aware of what it is?
These are just a couple of items that can help prevent being caught up in a phishing attempt.
Need help identifying other vulnerabilities in your network? Call Bedroc. We'll pull back the curtains on your network and evaluate your security posture.