Blog courtesy of KnowBe4
Written by Stu Sjouwerman
A new report from Barracuda found that most business email compromise (BEC) attacks are now targeting employees who aren’t in executive or financial roles.
“Many organisations focus their training and protection on who they perceive to be the most targeted individuals within the organisation—usually executive and finance teams,” Barracuda’s researchers write. “However, 77% of BEC attacks targeted employees in other departments. Attackers look for an entry point and a weak link within your organisation, and then they work their way to more valuable accounts. This highlights the need to secure and educate every employee to the same level.”
Barracuda also found that one in five BEC attacks target employees in sales roles.
“Due to the nature of their role, sales reps are used to getting external messages from senders they haven’t communicated with before,” the researchers write. “At the same time, they are all connected with payments and with other departments including finance. For hackers, these individuals could be a perfect entry point to get into an organisation and launch other attacks.” They also have access to a lot of contacts
IT departments were another prime target, with each IT employee being targeted by an average of forty attacks.
“When we look at the number of phishing emails targeting IT teams, although they received only 5% of the total number of attacks, each employee was targeted by 40 email attacks, which is well above average,” the researchers write. “IT staff has access to business-critical applications, so compromising their accounts can be extremely valuable to hackers as it will give them access to organisations’ security and IT infrastructure. Cybercriminals tailor their attacks to their victims, so there were barely any BEC attacks, which usually look for quick monetary return, targeting IT teams. However, when it comes to attacks that include phishing URLs designed to compromise accounts, IT was one of the top targets.”
New-school security awareness training can enable employees throughout your organisation to recognise and thwart social engineering attacks.
Barracuda has the full story.
Request A Demo: Security Awareness Training
New-school Security Awareness Training is critical to enabling you and your IT staff to connect with users and help them make the right security decisions all of the time. This isn't a one and done deal, continuous training and simulated phishing are both needed to mobilise users as your last line of defence. Request your one-on-one demo of KnowBe4's security awareness training and simulated phishing platform and see how easy it can be!