The mission of cybercriminals has largely remained the same – exploit vulnerabilities within an organisation for financial gain – but their methods continue to evolve to maximise their gains. Rather than targeting a business’ network or its endpoints in hopes of identifying a weakness, cybercriminals are capitalising on the trust inherent to human nature and deploying costly attacks to organisations through highly targeted emails.

They focus on the people in a business who have access to the information they want – and they target their victims through email, cloud apps, and social media.

While up to 60 percent of IT budgets are focussed on defending the network, email remains the most lucrative path – and the easiest – for hackers to compromise the enterprise.

The latest thinking in cybersecurity is, therefore, to focus on the people, and there is a new generation of cybersecurity protection systems that create visibility of who in the organisation is most at risk. By protecting people, the company’s data and brand get shielded from advanced threats and compliance threats.

Email remains the attack method of choice for hackers, and the numbers of threats from this vector are growing – email attacks are cheap to set up, campaigns are easy to run, and the paydays are lucrative, too.

Email attack compromises only need low volumes of attempts – relative to spamming campaigns, for instance – and don’t need high-end hacking techniques, the latter either purchased on the dark web or laboriously learned.

Geographies affected differ, as you might expect. A recent survey by Proofpoint has found that the volume of attacks in ANZ real estate, for instance, was around double that of companies targeted in the UK or US. Against retailers, attacks were 26 percent more likely.

The survey also found that there was no correlation between the size of the company and the number or complexity of the threats faced. The message here is that companies of all sizes need to be on their guard.

“Historically malware targeted system vulnerabilities, however, today over 99% of targeted attacks rely on the user to activate them. Some users are more easily fooled than others, and education makes a huge difference. “Security awareness has rapidly moved from a ‘nice to have’ to a ‘must have’,” said Tim Bentley, VP of Asia-Pacific & Japan, for Proofpoint.

Unlike the more technically complex attacks that are aimed at network infrastructures on the premises, email attacks can trick individuals into sending or wiring money through phishing attacks aimed at garnering credentials.

“Effective fraudulent email is often striking in its simplicity. These messages contain no malware and instead rely on users clicking links or enabling macros. An email thread can start with ‘Are you at your desk?’ and move on from there,” Bentley added.

In today’s changing IT infrastructure, the consequences of successful attacks multiply. Cybercriminals can use stolen credentials to send emails from genuine accounts and exfiltrate cloud log-on and administrative privileges from attacked individuals.

Email fraud attacks are the latest example of a trend in cybercrime: manipulating people into becoming unwitting accomplices to steal information and money.

Thankfully, security companies are now becoming aware that it’s the people within a company, not the infrastructure. that are the target. And these cybersecurity companies are beginning to bring products to market that are addressing the trend. This includes user education.

Tim Bentley of Proofpoint said: “Security awareness training is constantly evolving to address the current threat landscape. As a best practice, education frequency should vary according to the individual’s risk profile, and the content must be relevant to threats being received.”

Just by asking a few simple questions, companies deploying new security platforms and education programs can ensure their systems are safe from exploitation. Questions like:

• Who attacked me?
• What techniques did they use?
• Who was targeted?
• Who is at risk?
• Are there suspicious login attempts?

At Tech Wire Asia, we’d like to highlight the organisation operating in the APAC region that is helping companies to answer those questions, and to change the way organisations of all sizes are thinking about their staff’s approach to being online.

PROOFPOINT

Proofpoint is a leading cybersecurity company that protects organizations’ greatest assets and biggest risks: their people. Headquartered in California, USA, the company also operates out of over a dozen locations worldwide, including Australia, Singapore, and Japan.

With an integrated suite of cloud-based solutions, Proofpoint helps companies around the world stop targeted threats, safeguard their data, and make their users more resilient against cyber attacks. Leading organizations of all sizes, including more than half of the Fortune 100, rely on Proofpoint to mitigate their most critical security and compliance risks across email, the cloud, social media, and the web.

Proofpoint has been named in Gartner’s “Market Guide for Secure Email Gateways (SEGs)” and positioned as a leader in Gartner’s Magic Quadrant as a leader in security awareness computer-based training.

Every day Proofpoint secures more than five billion emails, billions of URLs and IP addresses, hundreds of millions of social media posts, and millions of mobile applications.

To protect your people, data, and brand, your defences must work where your people do – at the pace that they do. With customers in over half of the Fortune 500, read more about how you might benefit from the protection and training available for your systems and staff with Proofpoint’s offerings by clicking here.