Cyber Defense eMagazine November Edition for 2021

It’s not that people aren’t smart enough to spot a scam when they see one. The problem is that today’s
advanced phishing attacks are difficult to detect, given that they don’t contain the tell-tale signs that
employees are told to look out for. When you then add in the fact that cybersecurity is rarely front of mind
for all employees and that many are distracted by their overwhelming to-do lists, you can hardly expect
on every employee to spot every malicious email that they receive – even with training. For example, in
a previous report, we revealed that 45% of people had clicked on a phishing email at work because they
were distracted.
So how are these emails bypassing existing security solutions and which employees are most likely to
be targeted?
Who is being targeted?
According to our data, an average employee receives 14 malicious emails a year and cybercriminals
aren’t picky when it comes to company size, with our researchers finding that SMBs and enterprises are
targeted in equal measures.
However, employees in the retail industry were prime targets, with the average worker receiving 49 emails
per year – making retail the most targeted industry during this time. People working in manufacturing
received the second most at 31 emails per employee, per year. To put this into context, an employee in
the retail industry would have to successfully identify up to 50 carefully crafted emails a year to avoid
causing a serious security incident.
That’s not so easy when the emails are crafted using sophisticated techniques to avoid detection. These
include display name spoofing, whereby the attacker changes the sender’s name to someone the target
recognises; domain impersonation whereby the attacker sets up an email address that looks like a
legitimate one, and account takeover attacks where a bad actor poses as a legitimate customer or
employee, gains control of an account and then makes unauthorised transactions.
When are they being targeted?
We’re often told that bad actors borrow best practice from marketers. If that’s the case, most phishing
attacks would land in employees’ inboxes around 10AM on Wednesdays, but our research revealed a
different story.
The most malicious emails are delivered between 2PM and 6PM, with very little fluctuation day-to-day
(except over the weekend). This isn’t an accident. Since employees are more likely to make mistakes
when they’re stressed, tired, and distracted, the second half of the working day is likely a bad actor’s best
bet.
Cyber Defense eMagazine – November 2021 Edition 102
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.