Cyber Defense eMagazine May 2019

down for days while teams worked to rid their network of the infestation. The cost of the city’s response
to the cyberattack is estimated to be around $17 million. It is not known if this infestation was started by
a phishing email, but phishing email have the capability to deploy ransomware and infect networks once
ran by the recipient. Even though most organizations have spam filters which will catch and stop many
malicious emails from reaching their employees, some email will always get through, which is where
employee phishing training comes in.
When an organization’s prevention systems fail to block a malicious email sender it is up to the recipient
to catch that an email is malicious and deal with it accordingly. Your defenses don’t depend on high-tech
anti-hacking coding, as much as they do on your people knowing what to look for and reporting attacks
(Anti-Phishing, n.d.). Phishing emails can be tricky by their nature, but there are some things employees
can look for to help spot a phishing email. The “From” address of an email is often a quick way to tell if
an email is from a legitimate source because many scammers use email addresses that are close to
legitimate sender addresses but are slightly different. If recipients take a second and double-check these
“From” addresses, they should be able to catch the fake address and prevent the phishing attempt.
Phishing emails will also usually request urgent action from the recipient in the hope that they will act
quickly without thinking about their actions. Employees should be trained to be very cautious of any email
requesting immediate action and when in doubt staff should contact their IT department before taking
any action. Since most phishing emails are sent out to millions, the scammer needs to format the email’s
text to be relevant to most of its recipients, which is why a generic greeting can be a big red flag for a
phishing email. Another big red flag of a phishing email are incorrect hyperlink or website address. If an
employee hovers over a link in an email and the link that appears is different, then this is a strong sign
that the email could be malicious. When organization employees receive these tips and others from
Phishing training they are less likely to fall for the phishing attempt. A study performed by Gordon, Wright,
and Aiyagari (2019) found that among a sample of US health care institutions that sent phishing
simulations, almost 1 in 7 simulated emails sent were clicked on by employees. Increasing campaigns
were associated with decreased odds of clicking on a phishing email, suggesting a potential benefit of
phishing simulation and awareness.
According to HIPAA Journal (2018), A survey conducted by a consultancy firm Censuswide revealed that
one in five workers had not been given any security awareness training whatsoever, but even when
training was provided, many office workers still engaged in unsafe practices such as clicking hyperlinks
or opening email attachments in messages from unknown senders. This survey result helps emphasize
that just providing a training is not enough, but that you need to provide the right training for your
organization and your organization needs to enforce that training. Just like there is no one type of phishing
attack, there is not just one type of phishing training or training vendor. There are multiple vendors
available today that offer great phishing simulation and training for end users and I will briefly discuss
three noteworthy platforms include SANS Security Awareness, PhishingBox, and KnowBe4. SANS, a
company well known for its training courses, offers a well-rounded end user training course which
includes animations, live action scenarios, hands on simulations, and interactive cyber-attack games.
SANS tailors its trainings to a large audience by making it available in over 30 languages and delivering
training videos with subtitles, voiceovers, and transcripts. PhishingBox advertises their phishing
awareness training as an easy-to-use platform that is mobile friendly and has real-time reporting.
PhishingBox offers several training courses ranging from general information security to more targeted
phishing awareness training and allows the organization to create their own training. KnowBe4, a
54