Social engineering: everything you need to know

No matter how much you spend on complex hardware and software cybersecurity solutions, they can’t account for the source of 90% of successful breaches: your staff.

Cybercriminals utilise dozens of proven psychological techniques to encourage your staff to give them access to your and your organisation’s data and (in many cases) physical premises. We in the cybersecurity profession refer to these techniques as ‘social engineering’.

But what is social engineering, how do social engineering attacks work, and what are the types of social engineering? Join us as we present our essential guide, updated for 2023.

What is social engineering?

Social engineering is a term that covers a wide variety of attacks that leverage human vulnerability to gain access to sensitive information.

With the risk of being targeted by social engineers growing greater by the day, we must fully understand the different types of social engineering attacks and how best to avoid them.

How do social engineering attacks work?

Whether we like to admit it or not, we’re all creatures of habit.

Modern life is an almost constant blur of mundane tasks and activities. Naturally, we all want to find the easiest and fastest way to accomplish those tasks.

Unfortunately, that often means that we’re lax about security.

Simple things like using the same password across multiple accounts can make your life easier, but it leaves the door wide open to social engineers.

Social engineers find the gaps in our security habits and utilise emotional manipulation techniques to access sensitive information.

How is shoulder surfing used?

Shoulder surfing enables social engineers to see what services you use, your contacts, and most importantly, your passwords. After making a note of these, the shoulder surfer can then try to access your systems remotely or even impersonate you to gain access to confidential information.

Social engineering attacks come in all sorts of shapes and sizes, but the three most common ones to watch out for are:

Examples of social engineering

Social engineering attacks come in all sorts of shapes and sizes, but the five most common ones to watch out for are:

Phishing

Phishing attacks are a common form of social engineering that involves sending fake emails or texts, often claiming to be from a legitimate company or individual, to trick the recipient into revealing sensitive information such as login credentials or financial information.

To avoid falling victim to a phishing attack, it is important to be cautious of unsolicited communication and verify the sender’s identity before clicking on any links or providing personal information. You can also protect yourself by using spam filters and keeping your security software up to date.

A more advanced form of phishing is called spear phishing. This is when a social engineer goes the extra mile to tailor the email to their target after conducting extensive research on, or data-mining, their target. This results in more effective phishing attempts, which are harder to spot.

Baiting

Baiting is another form of social engineering that involves offering something desirable, such as a free gift or access to ‘exclusive’ content, in order to lure the victim into revealing sensitive information or performing a specific action.

To avoid falling for a baiting scam, it is important to be sceptical of anything that seems too good to be true and to be cautious of offers that require you to provide personal information or take specific actions.

Scareware

Scareware is a type of social engineering that involves tricking the victim into believing that their computer has a serious problem, such as a virus, and offering a solution for a fee. The “solution” is often unnecessary or ineffective, and the victim is scammed out of their money.

To avoid falling victim to scareware, it is vital to be aware of the signs of this type of scam, such as unexpected pop-up windows or warning messages, and to be cautious of any offer to fix a problem for a fee.

Pretexting

Pretexting is a form of social engineering that involves creating a fake identity or scenario to obtain sensitive information from the victim.

This can involve pretending to be a representative of a legitimate company or government agency to obtain personal information such as a social security number or bank account information.

To avoid falling victim to pretexting, stay cautious of anyone who asks for personal information and to verify the identity of the person before providing any sensitive information.

Impersonation

Impersonation is a type of social engineering involving pretending to be someone else to gain access to restricted areas or information.

This can involve pretending to be a co-worker, a maintenance worker, or someone else with legitimate access to gain entry to a secure area or obtain sensitive information.

Avoiding falling victim to impersonation isn’t easy, but by maintaining an awareness of your surroundings and being cautious of anyone who does not have proper identification or seems out of place you can increase your chances.

It is also a good idea to verify the identity of anyone who claims to be a co-worker or representative of a company before providing any sensitive information or allowing them access to restricted areas.

Is tailgating a form of social engineering?

Yes! The purpose of tailgating (also known as piggybacking) is to gain access to an unauthorised area.

Typically, this is achieved by an unauthorised person following closely behind an authorised individual and getting the authorised individual to give them access.

This might include following someone into a lift requiring a security key, often with some excuse like holding a large delivery or simply forgetting their key.

Social engineers rely on people’s instinct to be helpful, so the next time you open the door to someone you don’t recognise, don’t be afraid to question them.

What is Shoulder Surfing?

Shoulder surfing is another physical form of social engineering that criminals use to gather information. When people work on the go, they lull themselves into a false sense of security and don’t realise they could be being watched.

Criminals will look to identify people who work on the go either on their laptop or phone, follow them to a place that they might like to work, like a coffee shop, and get into a position where they can see what’s on the screen.

Is social engineering a cybersecurity threat?

While social engineering may seem simple, it represents a significant cybersecurity threat to organisations. While companies continue to invest in technological solutions to stay secure, they don’t fix the vulnerabilities social engineers look to exploit – people’s behaviour, habits and emotions.

Suppose a user is tricked into revealing details that can help an attacker through your defences, or tricked into allowing someone unauthorised access. In that case, all the technology in the world would be unable to help you!

Real-life examples of social engineering attacks

Marriott International

In 2018, the hotel company Marriott International reported that its subsidiary Starwood Hotels & Resorts’ reservation system had been breached, exposing the personal information of up to 500 million visitors. The hackers had gained access to the system by using social engineering tactics to obtain login credentials from an employee at a third-party vendor.

The attack began in 2014 and went undetected for four years. During that time, the hackers used the access they had gained to the system to collect guests’ personal information, including names, mailing addresses, phone numbers, passport numbers, and payment card information. The breach was only discovered in 2018 when Marriott received an alert from an internal security tool.

The attack was a sophisticated example of social engineering, as the hackers had been able to gain the trust of an employee at a vendor and obtain sensitive login credentials through seemingly legitimate means.

Hackers often use social engineering tactics to target employees at companies or organisations that have access to sensitive information, as these employees may have weaker security protocols in place and may be more likely to fall for scams or phishing attacks.

DHL

Another example of a social engineering attack in the UK occurred in 2018, when hackers targeted the courier company DHL Supply Chain. The hackers used ‘pretexting’ to obtain login credentials from an employee at the company and used those credentials to access the company’s systems. Once inside the system, the hackers were able to steal sensitive customer information, including names, addresses, and payment card details.

The attack was discovered when DHL received reports from customers that they had received spam emails claiming to be from the company. Upon investigation, DHL discovered that the hackers had gained access to its systems and had been able to collect customer information. The company promptly notified affected customers and implemented additional security measures to prevent further breaches.

This attack was a reminder of the importance of strong security protocols and the need to be vigilant against social engineering attacks. It is essential for companies and organisations to educate their employees about the risks of social engineering and to implement strong security measures to protect against these types of attacks.

LinkedIn
In 2016, the social media giant LinkedIn announced that it had discovered that a hacker had gained access to the passwords of 117 million of its users.

The hacker had used social engineering tactics to obtain an employee’s login credentials at LinkedIn and then used those credentials to access the user data. The data was later sold on the dark web, and many LinkedIn users reported that they had received spam emails or had their accounts compromised as a result of the breach.

The attack was a sophisticated example of social engineering, as the hacker had been able to gain an employee’s trust at LinkedIn and obtain sensitive login credentials through seemingly legitimate means.

In this case, the hacker had used a phishing attack to obtain an employee’s login credentials and then used those credentials to access the user data.

The attack was discovered when LinkedIn received reports from a number of users that they were receiving spam emails that appeared to be coming from their LinkedIn accounts. Upon investigation, LinkedIn discovered that the hacker had gained access to the passwords of a large number of its users.

The attack was a reminder of the importance of strong security protocols and the need to be vigilant against social engineering attacks. With sufficient cybersecurity awareness training, attacks like this can be prevented.

How to defend against social engineering attacks

Defence against social engineers largely depends on awareness and ensuring that you and your workforce know what to be wary of.

Even the very best security technology can be overcome by a clever social engineer, which is why security awareness training is so essential.

Teaching your staff about the dangers of social engineering with engaging, jargon-free training is the most effective way of protecting your organisation.

To help you safeguard against some of these attacks, your staff should:

Adopt a suspicion-first mindset
Complete training to learn spot the signs of phishing emails
Maintain a clear desk
Understand your organisation’s privacy policies
Protect themselves from malware through awareness
Treat any offers or requests from unknown people with suspicion

What is malware? The complete guide

You’re probably most familiar with malware from its regular appearances in the news, typically in relation to big organisations falling victim to it. Just last year, computing giant Nvidia were the victims of a ransomware attack that exposed its data to the world, costing the firm untold sums.

But do you really know what malware is? Join us as we dig into what malware is, the types of malware, how to spot malware and how to prevent malware on your home or work network.

What is Malware?

Malware (a contraction of malicious software) is a term used to describe any software that does unwanted things on your computer or device. It can take many forms, from viruses and worms to Trojan horses and ransomware, and can be spread through various means, including email attachments, malicious websites, and infected storage devices.

These nasties can include slowing your CPU, performing tasks of their own or locking your computer down and demanding a ransom. Some can also track your activities and steal sensitive data, such as passwords and files.

What are the types of malware?

Some variations of malware are:

Viruses

Computer viruses are malicious programs that can cause a lot of damage to your computer and the data stored on it. They can spread quickly and silently without user awareness, making them particularly dangerous. They can corrupt data, delete data, or even take control of a computer, allowing hackers to access personal information or even gain access to a computer’s operating system. This can lead to identity theft, financial loss, or even the destruction of a computer.

To protect yourself, it’s important to have a good anti-virus program installed and to keep it updated regularly. Additionally, be careful when downloading files or clicking on links in emails, and make sure you have a secure, up-to-date firewall in place. Taking these steps can help protect you from computer viruses’ potential dangers.

Worms

Worms are a particularly common form of malware that spreads via operating system vulnerabilities. The most common way that a worm does its damage is by overloading web servers and using up bandwidth.

They are also capable of carrying ‘payloads’, which are bits of code included to commit certain actions, such as creating botnets, stealing data or deleting files.

Worms are quite similar to viruses. However, there are a number of differences. The main distinguishing factor is that while viruses require user action to spread (running a program, opening a file, using a USB stick), worms often spread by mass-mailing themselves to contacts or similar.

Ransomware

Ransomware has seen plenty of exposure in recent years, owing mainly to the massive ‘Wannacry’ attack. This type of malware can literally hold a device and its contents hostage, while demanding a ransom to release your data.

Ransomware does this by encrypting a hard drive and displaying a message demanding the user pays a ransom to unlock the device. Ransomware often spreads just like worms, usually arriving in the form of a network vulnerability or downloaded file.

Adware

As the name suggests, this form of malware is designed to display unwanted advertisements; this includes pop-up ads and ads shown in the software.

Many free or compromised versions of software come bundled with adware, as it is used to generate revenue for advertisers. Often, adware is backed up by spyware (see below) or other malware to track your activities and steal your data, making it more dangerous than it might seem.

Spyware

This is malware that secretly monitors, records and sends your activities to a server or malicious attacker.

The types of information typically gathered by spyware include websites visited, system information, location and login credentials. Sometimes spyware has the capability to modify network, system and application security settings too.

Perhaps the most common types of spyware are keyloggers. They can infect a device and track your keyboard activity, sending copies of your usernames, passwords, bank details and more to criminals. For more, read our complete guide to keyloggers.

Browser Jacking

Browser-jacking malware is closely related to adware. It modifies your browser, ads toolbars, search engine & homepages and can add desktop shortcuts.

This malware can also redirect you to malicious sites and download adware and spyware.

Rootkit

A rootkit is designed to remotely control or access a computer without the user’s knowledge.

Once a rootkit is installed, its malicious owner can execute software, steal data, modify the system or change software (including any software that might have been able to detect the malware). In short, rootkit malware gives somebody else complete control.

This level of secrecy means you may be unable to find or remove a rootkit using typical security software. Consequently, detection and removal rely on manual methods such as monitoring for irregular behaviour.

Trojan

Trojan malware gets its name from the Greek tale of the Trojan horse. Trojans are programs that are disguised as legitimate files or software in an attempt to trick users into downloading malware.

Once a Trojan is installed, a malicious party can control the device remotely. When the attacker has access to an infected computer, they can monitor user activity, change files and settings, steal data or install more malware.

Bot

Bots are generally created to perform non-malicious tasks automatically. However, they are increasingly being used for more malicious purposes. Specifically, bots are being deployed in botnets, as spambots, web spiders scraping server data, and distributing malware on download sites.

Bots are the reason CAPTCHA tests exist, as they cannot usually pass this test without human input.

How to spot malware

Your first port of call in spotting malware should be your antivirus software. Running an up-to-date version of an antivirus scanner on a regular basis is vital in finding malware.

However, malware can appear between these scans, and can even evade them, so keep an eye out for the following symptoms:

Files changing, moving, or being deleted
Slow computer or network speeds
Increased system resource usage
Programs running, turning off or reconfiguring themselves (malware particularly likes to reconfigure antivirus software and firewalls)
Strange files or programs appearing
Messages or emails being sent automatically without you sending them
Any other strange behaviour you do not expect to see from your device

How to protect your organisation against ransomware

To protect yourself and your organisation against malware, it is important to implement a combination of technical and non-technical measures. Some key steps to take include:

Install and regularly update antivirus software: Antivirus software is designed to detect and remove malware from a computer. You can help protect your computer against new and emerging threats by installing and regularly updating antivirus software.
Be cautious when opening email attachments and links: Email is one of the most common ways malware spreads. Be wary of opening attachments or clicking on links from unknown sources, and always scan any attachments with antivirus software before opening them.
Use a firewall: A firewall is a security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. Using a firewall can block malicious traffic and help protect your computer from malware.
Enable automatic updates: Many software programs, including operating systems, offer automatic updates that can help protect against security vulnerabilities and malware. Be sure to enable these updates to ensure that your software is always up to date.
Use strong passwords: Strong passwords are a key defence against malware and other cyber threats. Use complex, unique passwords for all your online accounts, and consider using a password manager to help generate and store strong passwords.

Here are some of Bob’s top tips:

Don’t engage with emails from unknown sources
Be careful with physical media; don’t plug in flash drives or discs from unknown sources
Only download software and open attachments from trustworthy and reputable sources
Don’t open attachments from personal emails on work computers, as you are creating a potential security threat to your organisation
Don’t just ignore emails you suspect to contain viruses; always contact your IT department, as they can then inform the rest of your organisation
Keep your operating system, antivirus software and browser up to date
If a link or email looks dodgy, don’t click it!

The five biggest breaches of 2022

The year is up, and the results are in: 2022 was a remarkable year for data breaches.

The average cost of a data breach worldwide grew 2.6% from $4.24 million in 2021 to $4.35 million in 2022 – the highest level in the report’s history from IBM Security.

The financial costs of a data breach are undeniably substantial, but the actual effects on businesses go far further and include reputational damage, legal liability, and a loss of business and customer trust. Data breaches and cyberattacks are not going away; on the contrary, they are becoming more frequent and severe.

It’s an assertion that’s reflected in the aforementioned IBM report, which found:

– 83% of organisations studied have had more than one data breach.

– 60% of organisations’ breaches led to increased prices passed on to customers.

– 79% of critical infrastructure organisations didn’t deploy a zero-trust architecture.

– 19% of breaches occurred because of a compromise with a business partner.

But while small and mid-sized organisations face the largest threat, those companies do not hit the news. For those companies, a breach brings severe reputational damage due to heightened publicity. In this blog, we’re rounding up the five most high-profile breaches of the year, and seeing what we can learn from them.

Let’s get started.

2022’s biggest breaches

Uber

2022 saw a significant data breach at Uber, the popular ride-sharing app. The breach affected 57 million users, with the hackers gaining access to the personal data of both Uber’s drivers and riders. In addition to the names and emails of users, the hackers also gained access to driver’s license numbers and other sensitive information.

Uber has taken steps to address the breach, including providing free credit monitoring and identity theft protection to those affected, as well as notifying law enforcement and taking measures to improve the security of its systems.

However, this breach is a reminder of the importance of data security and the need for companies to take steps to ensure that customer information is secure. Organisations must take the necessary steps to protect their data and stay ahead of potential threats.

Rockstar Games

This year, the popular video game company Rockstar Games was the victim of a data breach. The breach involved hackers gaining access to the personal and financial data of Rockstar customers.

The breach was discovered when some Rockstar customers reported unauthorised charges on their credit cards. It is believed that the hackers were able to gain access to the data through a vulnerability in the company’s website.

Rockstar Games has since taken steps to secure the data and protect its customers. They have implemented a new security system and are monitoring their systems more closely. They have also offered credit monitoring services to those affected by the breach.

Overall, the Rockstar Games data breach serves as a reminder of the importance of cybersecurity. Companies must remain vigilant in protecting their customers’ data, as a breach can have serious implications for both the company and its customers. It is essential to stay informed of the latest security updates and take steps to protect your data.

Revolut

This year, the financial services firm Revolut experienced a major data breach that compromised some of its customer’s personal information and passwords. It was discovered that some user accounts had been accessed without authorisation.

Upon further investigation, Revolut determined that an unauthorised third party had gained access to a database containing customer information, including names, email addresses, phone numbers, and hashed passwords.

In response to the breach, Revolut took immediate steps to secure the accounts of the customers affected and reset the passwords of all users in order to protect their accounts.

The company also contacted those affected by the breach and provided guidance on protecting their personal information. Revolut also took the opportunity to remind customers to use strong passwords and always enable two-factor authentication on their accounts.

Overall, the Revolut data breach serves as a reminder that we need to take data security seriously, as our personal information is an important asset and must be protected.

Twitter

This year, Twitter suffered one of the largest data breaches in its history.

In July, hackers managed to access the personal data of over 130 million users, including email addresses and phone numbers. The breach was made possible through a vulnerability in Twitter’s security systems. Twitter responded quickly to the breach and took steps to secure users’ data and accounts. They also provided users with information on securing their accounts and protecting their data.

This data breach serves as a reminder of the importance of staying vigilant about your online security. Strong passwords and two-factor authentication are important to protect yourself from data breaches. Additionally, be aware of any suspicious emails or messages that you receive and never give out personal information.

SHEIN

This year, SHEIN, a global fashion retailer, experienced a data breach resulting in the personal information of millions of its customers being compromised. The breach was discovered on May 15th and impacted customers who used the SHEIN mobile app, website, or physical stores.

The data breach included names, emails, addresses, and payment information. Shein has since taken steps to address the breach, including patching the affected system, strengthening security protocols, and notifying affected customers.

It also advised customers to be vigilant and monitor any suspicious activity on their accounts. The incident serves as a reminder that data security is an important issue and that companies need to take proactive measures to ensure the safety of their customers’ data.

Although these have been the top 5 biggest breaches of 2022, millions of companies, large and small, have paid the price.

If your organisation doesn’t yet have a solid cybersecurity strategy in place, we have opened our diaries for 2023. We’re offering free, no-strings-attached, one-to-one sessions with our cybersecurity experts to demystify cyber and make behavioural and cultural change a reality in your organisation.

On your call, we’ll answer any questions you might have about cybersecurity and help get your 2023 off to a cyber-secure start!

Want to get started? Simply click here and enter your details to get your slot.

Why cybersecurity is an onboarding essential

Onboarding new members of your team can be tough. From new processes to follow to adjusting to dynamics within the company, it can be just as hard for an organisation to adapt to a new team member as it is for that team member to adjust to the organisation.

It’s a period where onboarding becomes genuinely essential. Onboarding processes help your new team member acclimate to your organisation, get to grips with your procedures and raise knowledge levels around mission-critical topics.

Whilst onboarding varies from organisation to organisation, there’s one thing that no organisation can do without – cybersecurity training.

Training employees in cybersecurity is essential for any business that handles customers’ confidential information. Not only does proper cybersecurity training help protect sensitive customer data, it also helps new employees understand their role in protecting the organisation’s sensitive information and systems.

By providing cybersecurity training during the onboarding process, organisations can ensure that all employees have the necessary knowledge and skills to protect themselves as well as the organisation from cyber threats.

Additionally, early training can help foster a culture of security within the organisation, where employees are vigilant and proactive in protecting against cyber threats.

As you can see, deploying cybersecurity training from day one can have serious benefits, but how do you go about it? Join us as we take a look.

Assign a course as part of your welcome pack.

Incorporating an entry-level cybersecurity module into your onboarding documentation is a valuable step towards ensuring your organisation is well-protected against common threats an employee will face.

This module should provide information on the most common cybersecurity threats, such as phishing, malware, and ransomware. Additionally, it should include best practices to protect data, such as avoiding clicking on suspicious links, using strong passwords alongside two-factor authentication, and regularly updating software.

It is also important to educate employees on the importance of protecting their data as well as the organisation’s data, and to ensure that any data shared externally is done so securely. By taking these steps, your organisation can ensure it is well-protected against cyber threats.

Take the time to explain why cybersecurity training is important

The first step in any successful cybersecurity awareness training programme is ensuring that every single person in your business understands why they are a crucial part of the security of the company.

Start by highlighting the risks associated with not having a good understanding of cybersecurity, such as data breaches and the potential damage they can cause. Then, explain the benefits of cybersecurity training, such as improved security and protection of sensitive data.

Finally, demonstrate the value of the training by setting clear expectations about what the training will cover and the skills the employees will learn. Encourage employees to ask questions and support them during the training process. By taking these steps, you can ensure that your employees are well-informed and engaged in their cybersecurity training.

Creating an environment of excitement and enthusiasm for cybersecurity training can be challenging, but it is certainly achievable. Here are a few tips to make your employees more engaged and enthusiastic about cybersecurity training:

– Focus on the importance of cybersecurity training: Make sure your employees understand the importance of cybersecurity training and the many ways it can help protect their personal information, your business’s data, and job security. Explain the value of cybersecurity training, and highlight the measures your organisation is taking to ensure its safety.

– Make the training fun and engaging: With so many online training materials and courses available, it’s easy to make cybersecurity training more interactive and engaging. Incorporate quizzes, videos, and other interactive elements to keep your employees engaged and interested in the material.

– Offer incentives and rewards: Incentives and rewards can be a great way to encourage your employees to engage in cybersecurity training. Offer rewards for completing courses or for taking on additional training.

– Get creative: Consider offering different types of training activities that encourage creative thinking. Team building exercises and games can be a fun way to engage employees in cybersecurity training.

By focusing on the importance of cybersecurity training while making the training interactive and fun, offering incentives and rewards, and getting creative, you can easily excite your employees about cybersecurity training. With these tips, you can ensure that your employees are well-informed and up-to-date on the latest security best practices.

Set employee cybersecurity expectations

Setting employee cybersecurity expectations is an important part of keeping your team on board with training and your organisation safe. The good news is that onboarding is the perfect opportunity to set those expectations.

Although your stated expectations will vary, we recommend the following:

– You are expected to complete any and all training courses you are assigned.
-You are expected to report any suspicious activity, phishing emails or suspected malware.
-You will never be punished for making a mistake which leads to a breach.

The last point is crucial to build a positive cybersecurity culture. People are people, and although regular training regularly reduces the potential of mistakes, when they do occur, employees need to know that you won’t punish them for those errors.

By destigmatising cybersecurity mistakes, you encourage employees to come forward and reduce the impact of a breach by catching it early and securing your systems.

How Bob’s Business makes onboarding easy

Full access to a diverse training catalogue

No matter what your new employee’s role is, our course catalogue has something to suit. Whether that’s GDPR training, anti-bullying, fire safety, phishing awareness or any other topic you might require, there’s no stone left unturned. Whether it’s our NCSC-certified GDPR and cybersecurity awareness training or any of our other uniquely engaging and effective courses, our training packages offer full access to our catalogue at an affordable price.

Included LMS for all your onboarding needs

Bob’s Culture and Bob’s Compliance includes access to your own customisable organisational Learning Management System (LMS), branded to match your organisation.

It’s where your team will access their courses, but that’s not the only feature, because your LMS is the ultimate onboarding tool for your team. With features including custom course uploads, user group functionality and more, you’ll be amazed at how easy our LMS makes onboarding.

Policy document tracking and attestation

With Bob’s Culture and Bob’s Compliance, we make it simple to ensure complete compliance with your organisation’s policies. Simply upload your policy documents and assign them to your team.

Built-in attestation tracking functionality means that you can see who has – and hasn’t – accepted your organisational policies too, to make onboarding a cinch.

Your cybersecurity jargon buster

Cybersecurity is a vast sector incorporating countless aspects of offline and online vulnerabilities. More than that, it affects everyone, from businesses and not-for-profit organisations to individuals in their everyday lives.

From the outside, it can seem like an overly complex topic, especially for those who aren’t tech-savvy. One of the biggest barriers to entry is the sheer amount of jargon, acronyms and terminology that can overcomplicate cybersecurity and make people switch off towards the subject.

That’s why we’ve put together this helpful guide to help you break down cybersecurity terminology into something easy for you and your staff to understand.

Let’s get started.

Cybersecurity jargon buster

What is an Acceptable Use Policy (AUP)?

In most organisations, an acceptable use policy is a set of guidelines outlined by an organisation that states how employees are supposed to use its resources and equipment.

What are Access Controls?

Access controls are a security method that manages and controls who or what is allowed to access a computer system or restricted area. It identifies who should have access and verifies details to decide whether to grant or deny access.

What is an Antivirus?

An antivirus is a type of software program that scans for and removes malware from devices.

What is a Botnet?

A Botnet is a network of compromised computers or computer systems, sometimes called a ‘Zombie Network’.

To create a malicious botnet, a cybercriminal will simultaneously compromise several computers and instruct them to run automated systems on the systems.

This can then be used to spread viruses, launch phishing campaigns or crash web servers.

What is a Bring-Your-Own-Device (BYOD) policy?

A policy that allows employees to use personal devices instead of company devices to connect to an organisation’s network and access business applications and data.

What is a Clear Desk Policy?

A Clear Desk Policy directs all staff members to maintain a clean working space throughout the day and file everything appropriately.

A clear desk policy can include more than just making sure your physical desk is clear; it can also include your computer, requesting that all files are locked away in secure folders within your PC subsystem and that your computer is locked when you leave it unattended.

What is a Data Breach?

A Data Breach is a security incident in which your sensitive, private and often valuable data is stolen, viewed or used by an unauthorised individual. Breaches can involve anything from financial records to corporate intellectual property and represent one of the biggest threats to organisations.

What is a Data Subject?

A data subject is any individual whose personal data is being collected, held or processed.

What is the Dark Web?

Encrypted web content which isn’t indexed by search engines or accessible through standard web browsers. Users need specialised software to access the dark web, like the Invisible Internet Project (I2P) or Tor browser. These browsers route user web page requests through third-party servers, hiding their IP address.

What is a DDOS Attack?

A DDOS Attack, or Distributed Denial of Service Attack, is when many computers are used to flood a targeted system. These are typically delivered by botnets and are usually global in nature, used to take down larger targets and cause widespread disruption.

What is a Digital Footprint?

A digital footprint is a unique trail of personal data every internet user leaves behind when engaging in digital activities. This data is typically publicly available and can be used to impersonate you. To learn more, why not check out our Digital Footprint course?

What is a DOS Attack?

A DOS Attack, or Denial of Service Attack, is when a single computer is used to flood a targeted system, rendering it unable to function for a period.

What is Encryption?

In computing terms, Encryption is the process of encoding data so that only authorised parties with the right decryption access can view or edit the data. This is widely used for security purposes but is also used by designers of Ransomware to lock users out of their own data.

What is a Firewall?

A network security device that filters all network traffic (incoming and outgoing) to prevent unauthorised access based on predetermined security rules. It’s important to note, however, that Firewalls must be continually updated in order to maintain effectiveness.

What is Information Confidentiality?

Certain information must be protected so only authorised individuals can access and view it. This process is known as maintaining information confidentiality.

What is the Internet of Things?

A network of physical objects with embedded sensors that connect to and exchange data over the internet in real time.

What is ISO 27001?

ISO (International Organization for Standardization) 27001 is a part of the ISO 27000 family, a group of international standards for Information Security Management Systems (ISMS). It helps organisations to follow best practices to mitigate cyber threats. Learn more about ISO 27001 here.

What is a Keylogger?

In its basic form, a Keylogger can either be a physical piece of hardware or software that intercepts signals from your keyboard and records every keystroke you make.

Keyloggers intercept the communication between your keyboard and computer before transmitting that information to a third party.

What is Malvertising?

Malvertising is a blend of malicious advertising. Malvertising is the practice of incorporating malware in online advertisements.

What is Malware?

Malware (a contraction of malicious software) is a term used to describe any software that does unwanted things on your computer or device.

What is Multi-factor Authentication (MFA)?

An authentication method where users must prove their identity using at least two different credential types before receiving access. This is increasingly standardised online, but may be called two-factor authentication (2FA).

What is the NIST Cybersecurity Framework?

A set of cybersecurity best practices that organisations can use to manage their security risks. The framework is voluntary guidance.

What is PCI DSS?

PCI DSS is an information security standard set out by the Payment Card Industry Security Standards Council to reduce fraud and increase the security around cardholder data.

The standard sets out requirements for how businesses should securely process, store, accept and transmit cardholder data during credit card transactions. To learn more about PCI DSS, click here.

What is Penetration Testing?

Known colloquially as pen testing. A simulated cyber-attack against a web application, computer system, or network. The goal of penetration testing is to find any vulnerabilities that could be exploited by threat actors and test defenders’ security posture.

What is Phishing?

Phishing is the most common tactic cybercriminals use to steal your data. At its most basic, it’s the act of creating realistic-seeming emails designed to get you to hand over your personal information.

These emails can mimic big companies, resemble an internal source or make an emotional plea. Awareness and vigilance against phishing are essential to protect your personal data and your organisation’s data.

What is Ransomware?

Ransomware is a specific subsect of malware which holds your data to ransom by encrypting all the data on your device or system and demanding payment to return it to an unencrypted state.

Many ransomware attacks feature a countdown timer and will delete your data unless you make a payment.

What is Remote Working?

Remote working is, quite simply, the act of doing your job away from the office. Whether it’s editing information on the train or accessing your work emails at the coffee shop.

Working on the go can leave you open to dangerous threats, like social engineering and shoulder surfing.

What is a Risk Register?

A risk register is used to document all known risks and helps to keep track of them. Risk registers should include the risk impact and likelihood, response taken, and who is responsible for monitoring the risk.

What is Shoulder Surfing?

Shoulder surfing is the practice of physically spying on another user’s electronic device to obtain their personal identification number, password and any other sensitive information.

What is Smishing?

Smishing is using SMS messages that social engineers use to commit phishing attacks.

What is Social Engineering?

Social engineering covers techniques cybercriminals use to access sensitive business and personal information.

Cybercriminals can and will use a variety of methods to exploit people, from sending an email designed to make them panic to pretending that they are a new employee that has lost their pass to access unauthorised areas.

What is Spear Phishing?

Standard phishing attacks are designed to be sent to a broad range of individuals to increase the chances of landing a hit. However, some cybercriminals are interested in attacking a single client.

For this, a technique called Spear Phishing is used.

This more targeted type of phishing utilises specific details gleaned from research to create truly effective and realistic phishing emails. Sometimes the term ‘Whaling’ is used when spear-phishing targets top-level management.

What is an SSL Certificate?

SSL, or Security Socket Layer, is a widely used website security protocol that encrypts data sent between you and a website. With an SSL Certificate in place, the connection is encrypted when your web browser connects to the secured and certificated website. This protocol has replaced the TLS, or Transport Layer Security.

You can tell whether a website has an SSL certificate by checking if there’s a closed padlock icon at the left of a website’s URL.

What is Stalkerware?

Stalkerware is a class of software designed for smartphones that record your location, the websites you visit, the apps you use and virtually any other data that comes through your smartphone. It then passes that information onto an individual.

What is Tethering?

Tethering is the sharing of your phone or mobile network-capable device’s internet with your computer. This can be done wirelessly or through a wired connection. This is typically more secure than using an open public WiFi.

What is Vishing?

Vishing is the use of phone calls to conduct phishing attacks. These calls will purport to be from a legitimate source, like the Royal Mail, Amazon or your bank, but will, in fact, be scammers looking to utilise psychological principles like fear to convince you to hand over your personal information.

What is a VPN?

A VPN, or Virtual Private Network, is a tool that makes web traffic anonymous by masking the location and encrypting traffic. VPNs are used in business to create secure channels to private servers and in the public sphere to secure browsing and access websites which are region-locked.

What is a Watering Hole Attack?

A watering hole is a website that has been infected with malware by a cybercriminal. The term comes from real-life watering holes, which are used by animals like hippos and alligators to hide in before launching attacks on unsuspecting creatures.

What is Whaling?

Whaling is a type of phishing attack that targets high-level executives. Whaling attacks typically involve complex and hard-to-spot social engineering efforts that use knowledge about an executive’s professional and personal network against them.

Don’t forget to bookmark this page in your browser so you can refer to it the next time you’re confused by some cybersecurity jargon!

Compliance training: everything you (and your organisation) need to know

No matter the scale of your organisation, compliance training is necessary to safeguard you and your organisation from legal issues further down the line.

You may have heard other organisations talk about it and even know that your company needs it, but you might need help understanding why.

Join us as we share precisely what compliance training is and answer some of your most pressing questions about compliance training.

What is compliance training?

Compliance training can cover a range of different topics, but its overall goal is to educate employees about the legal and internal policies which apply to their roles and daily activities in their position.

The main purpose of compliance training is to walk employees through ethics and regulatory issues that could arise in the workplace and train them on how to guard against them effectively.

What issues are covered by compliance training?

As we have already mentioned, compliance training can cover many essential issues in the workplace, depending on the sector you work in. In our case, for example, we offer compliance training which covers topics relating to information security, such as ISO 27001, and environmental standards, such as ISO 14001.

Other issues which often require compliance training include company policies, codes of conduct, diversity and inclusivity in the workplace, and business ethics. Certain industries, such as healthcare and finance, will have even more compliance training in place than other businesses due to the highly regulated nature of those sectors.

Why is compliance training so important?

Whilst the importance of compliance training might not be immediately apparent, we’ve all seen heavy fines levied on businesses charged with non-compliance or a breach of regulation. Avoiding those fines is the most important reason to undergo compliance training.

While no employee breaks the law knowingly – except for rare occasions – many times, a compliance issue can occur unknown to the responsible party out of lack of knowledge or understanding.

Of course, the reasons for undergoing compliance training continue beyond avoiding fines. Compliance training enables your entire organisation to work safely and efficiently from the same page, reducing confusion and friction within the business environment.

The right training ensures that your organisation remains compliant at all times and equips your employees with the knowledge needed to spot any non-compliance or potential issues they may come across in the business.

What is a compliance certification?

A compliance certification is a fully accredited document certifying that your business meets the standards demanded by the certification specifications.

What are the best practices for compliance training?

Set out clear objectives

Understanding why you must do something can often increase motivation as it’s easy to attribute results to your behaviour. Training can feel much more valuable to employees when they understand the importance of compliance training, and it can even feel like an internal competition for them.

Make training interesting

There’s no need to make your employees sit through tedious training packed with hard-to-understand jargon when there are so many good alternative methods.

eLearning can be beneficial in many ways to both you and your employees. Employees can take as many breaks as they need because the training is broken down into bite-sized modules that are easy to understand. eLearning also allows learners to finish their training whenever they are ready.

As a result, fewer people rush through because they believe their time and effort would be better spent on another project. Because only some employees learn in the same way or within the same time frame, your employees will appreciate it if you give them the option to complete their training whenever they want by a specific deadline.

Instead of handing each employee a stack of papers every year, invest in interactive scenarios and simulations that allow learners to test how they would respond in various situations via eLearning.

– Think of ways to incorporate interactive content – e.g. quizzes or games. This can be a good way to enhance learning and engage participants.

– Focus on practical applications – not the situations that are least likely to occur, but the situations in which employees are very likely to find themselves. These are the kind of scenarios that can make an impact.

– Encourage input and active discussion. To impact employee engagement, you need to engage them. Create an environment that is open, transparent and two-way.

Make compliance issues relevant to your employees

Making an employee go through a lengthy cybersecurity awareness training programme that is unrelated to their work or day-to-day responsibilities is the fastest way to lose interest and stop learning. Since your employees must receive compliance training, you must ensure that the material is relevant to keep their interest.

Ask for feedback on the training experience

Your staff want to feel like their thoughts and opinions are respected. Their excitement and motivation will decline, and you’ll probably have a higher staff turnover rate if you don’t pay attention to their suggestions and worries. Not just compliance training but entire corporate culture is affected by this.

Inquire about their opinions of the training, any changes they would make, and the overall experience. Their input enables you to continuously enhance your compliance training process and guarantee that employees benefit the most from it, which benefits the entire business.

So, how can our compliance training help your business?

We believe in making training as simple, relatable and effective as possible, and our compliance training is no different. Through our gamified training, employees never feel as though it’s a tick-box exercise that they need to get done.

Bob’s Business is your first port of call regarding cybersecurity compliance training. Offering comprehensive online training, our compliance courses can be tailored to suit both the public and private sector and can be scaled to suit businesses of any size, from small enterprises to large organisations.

To make compliance easier for staff to digest, our compliance training courses are bite-sized for a more efficient learning experience.

For more information about how we can help your business achieve compliance, get in touch with a member of our team today.

This month in data breaches: November edition

The season of good cheer is upon us, but not for every company.

Even as many businesses start to wind down and Christmas parties get into full swing, careless errors can still cost your company thousands.

Throughout November, social media platforms and public services suffered significantly from these data breaches. Curious? Read on to see the big names breached, and to discover how these breaches could have been prevented.

Twitter

It has been a wild couple of months for Twitter recently, with new rules, a new owner, and two data breaches arriving in short order!

Last year a Twitter vulnerability allowed hackers to acquire Twitter IDs, names, login names, locations and verified status; it also included private information, such as phone numbers and email addresses, even if the user had hidden these fields in the privacy settings.

The bug was reportedly specific to Twitter’s Android client and occurred with Twitter’s API.
The vulnerability had already been patched by Twitter in January 2022.

In November 2022, though, after this stolen data was made public online, last year’s breach has returned to haunt Elon Musk’s platform.

According to BleepingComputer, security expert Chad Loder, who first broke the story on Twitter and was removed shortly after publishing it, was the source of information about this more serious data leak. Following Elon Musk’s takeover of Twitter, Loder shared a redacted excerpt of this broader data breach on Mastodon, a social media platform many former Twitter users migrated towards.

Hereford School

A Herefordshire School has been the victim of a recent data leak, but what can we learn from it?

It was revealed that hackers had stolen students’ personal information, including names, ages and addresses, and have since published this on the dark web.

Although the root cause of the data breach is unknown at present, the Executive Head has announced extra measures to counteract such attacks in the future by introducing “two-factor authentication, robust passwords and antivirus software, in place to try and avoid the attacks.”

It’s just another example of a data breach highlighting the need for a robust cybersecurity awareness training programme within organisations big and small.

Reading GP

An NHS review has been prompted by a Reading GP clinic’s “major data leak” that exposed nearly 300 private email accounts.

The South Reading & Shinfield Group Medical Practice sent out an email to clients inviting them to a patient involvement group meeting. In this email, 288 email addresses were carbon copied (CCd) into the invitation, but they were not blind CC’d by the sender (BCC).

The inclusion of email addresses in the standard CC created the risk of disclosing personal information to individuals who did not know one another, which amounted to a personal data breach.

One of the recipients replied, “Probably not the best to have everyone’s email public here. I’m replying all just to let people know.”

In May 2020, at the start of the Coronavirus pandemic, an outsourcing business named Serco made a mistake similar to this one by mistakenly disclosing the email addresses of 300 persons who were undergoing training to support the government’s “track and trace” service.

A staff member sent an email to recipients requesting that they not contact the help desk for information regarding their training; however, all personal email addresses were included in the CC area rather than the BCC section. This led to the breach. That implied that everyone who got the email could clearly see the personal email addresses of all the other trainees.

This is a perfect example of a workplace mistake that may have been easily prevented. It’s easy to assume that all employees automatically understand email etiquette in the workplace when the reality is often the opposite.

It’s yet another reason why cybersecurity and compliance training is essential for every organisation – no matter their size. Ready to deploy training your team actually want to take? Check out our product range here.

5 cybersecurity trends every CISO must prepare for in 2023

Recent years have seen the conversation about cybersecurity move from the IT department to the board room. Cybersecurity is now a top priority at every organisational level, with the number of attacks and potential penalties, both regulatory and in terms of loss of customer trust, increasing.

The potential surface area for an attack has grown rapidly thanks to the complications and costs driven by the Covid-19 pandemic-related shift to a culture of home and remote working that has persisted in many organisations as well as the internet of things (IoT) spreading into every sector of business and society.

Cybersecurity never stands still, however, and with 2023 on the horizon, we thought it valuable to look ahead and predict some of the major trends we foresee playing a role in the next 12 months. Let’s get started:

The 5 trends every CISO needs to look out for in 2023

Artificial intelligence (AI) will play an increasingly prominent role in cybersecurity

We’re all only human, and as such, there’s a limit to what we can see, process and respond to.

Human cybersecurity experts are finding it increasingly difficult to respond to all attempted cyberattacks and predict where the most dangerous attacks will occur next, as they have multiplied rapidly.

As such, artificial intelligence (AI) may prove to be an increasingly valuable tool. Machine learning algorithms can study the massive amounts of data flowing across networks in real-time more efficiently than humans can and learn to spot patterns that indicate a threat.

Unfortunately, hackers and criminals are growing more skilled at exploiting AI as it becomes more readily available. Just as security experts can utilise AI for good, so can criminals.

Bad actors use artificial intelligence algorithms to find vulnerable systems or networks among the millions of computers and networks linked to the internet. The ability to automate the mass production of personalised phishing emails has been another significant use, and such emails are getting better at dodging automatic email defence systems too.

The use of AI in cybersecurity has even been given its own name and is commonly referred to as an ‘arms race’ as hackers and cyber professionals race to ensure the newest and most sophisticated algorithms are working on their side as opposed to against them.

It’s been predicted that by 2030 the market for AI cybersecurity products will be worth close to $139 billion – a ten times increase on the value of the 2021 market.

Building a security-aware culture will be more vital than ever

Developing and fostering a culture of awareness around cybersecurity risks is the most crucial measure that can be made at any organisation. Employers and employees can no longer simply consider cybersecurity to be an issue that the IT department should handle.

In reality, everyone’s work description in 2023 should include developing an awareness of the threats and taking basic precautions to ensure safety!

Phishing attacks use social engineering techniques to trick victims into disclosing sensitive information or installing malware on their computers.

Even without technical expertise, anyone can learn to recognise these types of attacks and take simple safety precautions to protect themselves. That’s why implementing cybersecurity awareness training within every organisation, irrespective of size will be fundamental for the success of any organisation in 2023.

Similarly, fundamental security skills such as secure password usage and understanding two-factor authentication (2FA) should be taught to everyone and regularly updated. Taking simple safeguards like these to promote a culture of cybersecurity awareness should be a major component of business strategy if an organisation wants to ensure that they create resilience and preparation over the next 12 months.

Increased accountability will be demanded supply chain

Customers’ inspection of the security supply chain will intensify in 2023. The Cyber Resiliency Act is already in effect in Europe, and a modification to the NIST framework is being proposed in the UK to transfer some accountability to the providers.

Due to the growing risk of fines, rising costs and the complexity of cyber insurance, businesses will under increased pressure from both customers and authorities to offer security solutions that have been accredited. Expect a 9% increase in 2023 in the number of UK companies being penalised for failing to protect sensitive information and personal data.

Curious to discover more about how to defend your organisation against supply chain attacks? Read our blog on supply chain attacks here.

Mobile will be the new target

In 2019, mobile banking malware or attacks are expected to expand significantly, by as much as 50%, making our handheld devices a seriously viable target for hackers.

With personal computing shifting away from the laptop and desktop PC, it’s no surprise to hear that our phones are the new frontier. Keep a close eye out for stories around smartphone security, with malware or viruses specifically designed to affect smartphones in 2023.

IoT on 5G networks will be under the magnifying glass

With the launch and expansion of 5G networks, the Internet of Things will usher in a new era of interconnectivity (IoT). Additionally, because of the connectivity between numerous devices, they are vulnerable to outside interference, attacks, or unidentified software bugs.

Even Chrome, the most popular browser in the world, has been found to contain significant security faults over the years. Because 5G architecture is still relatively new in the market, extensive study is needed to identify vulnerabilities and strengthen the system’s defences against outside attacks. The 5G network may experience several network attacks at every stage that we are unaware of.

Why organisations need to prepare for the Metaverse’s security risks

You might have heard a little bit about the Metaverse. Whether that’s Facebook’s $15 billion spent on the project so far, the giddy sounds of advertisers or users’ apparent limited enthusiasm to date, it’s almost certain you’ve heard something about the project by now. But what is the metaverse, actually?

In essence, Facebook argues that the metaverse Facebook is a new and “improved” form of the internet that combines augmented reality (AR) and virtual reality (VR) to provide a completely immersive online experience.

In other words, it’s a version of the web in which “you”, represented by your online avatar, can work, play, study, shop, and interact with friends while feeling as if you’re truly present.

Although the word “Metaverse” has been floating around since the early 90s, the term didn’t truly catch on until Facebook changed its name to Meta in October 2021. At that time, the company disclosed plans to invest $10 billion in technology over the following year in order to realise its metaverse goal of a Facebook-controlled online ‘everything’ platform.

While the metaverse might bring benefits to users, like any other internet-connected innovation, there will be cyber criminals, fraudsters and scammers who will be looking to exploit it – and that’s going to create cybersecurity and privacy challenges from the beginning.

Why do I need to worry?

Cybercriminals are nothing if not opportunistic. The pandemic’s massive shift to remote working saw a significant increase in cybercrime as criminals took advantage of the uncertainty and change.

The metaverse’s big sales pitch is that it’s an entirely new way to interact, work and play online. Naturally, then, where people are learning how to behave and what to do, criminals will be out in force. It’s not speculation on our behalf either, with a survey of 100 senior security experts found that 91.5% are concerned with the potential security risks of the Metaverse itself.

What are the concerns around Metaverse security?

It’s easier than ever to impersonate somebody

One of the key aspects of the metaverse is that users are represented in virtual environments by customised avatars – but how will you be able to tell the person you’re interacting with is really who they say they are?

“I can go into the metaverse, I can make an avatar that looks like you, and I can give it a name that says it’s the real you – and I will probably trick some people into thinking that it’s you,” says Caroline Wong, chief strategy officer at Cobalt, a cybersecurity and penetration-testing company.

Cybercriminals use social engineering to steal passwords, personal information, and money through phishing emails and messaging scams, which are already highly successful on the internet as it is today.

That might be even simpler in the metaverse, especially if individuals mistakenly believe they are communicating with the physical representation of an individual or company they know and trust when in fact, they are communicating with someone else entirely.

For organisations, if it’s possible that a fraudster could create an avatar that looks like you, then uses that to help conduct attacks against your friends or colleagues – or as with any other online account, they could just hack into the real one.

If you are doing business with someone in a virtual world and someone else can take over their account, it could be very hard to spot.

Privacy remains an issue

For organisations, privacy is a major topic of concern. Metaverse businesses must protect critical and sensitive user and transactional data.

More user data than ever before will undoubtedly be gathered as a result of the development of a more customised and immersive experience, which makes for a more attractive target for cybercriminals.

Indeed, the emerging nature of the metaverse means that there are questions about whether existing governance and oversight are sufficient for what the metaverse is and may become.

What can your organisation do?

The metaverse is currently only a small part of how we use the internet, but the money that’s being invested into it suggests a high degree of confidence that it may eventually become a major part of our lives.

If Facebook and their partners get their way, the metaverse may potentially change the way we work, socialise, and play online in the future. The potential for good is huge, however, there will always be those attempting to take advantage of social environments on the internet. That’s why we recommend that organisations that wish to participate in the Metaverse take precautions to be secure. Here are our top recommendations.

Always use a VPN

VR technology can acquire a large amount of biometrically inferred data, even down the movement of your eyes. Moreover, an app may reveal your physical location when using the Metaverse. You may feel more comfortable using a VPN to keep your whereabouts hidden.

A few ways that a VPN may be desirable include:

Keep your IP address hidden: When you’re in the Metaverse, you may want your IP address hidden. A VPN can help ensure your privacy and keep your identity protected.

Access blocked websites and content: Some websites and content are blocked in specific regions or countries. A VPN can help you access this content no matter where you are in the world.

Multi-factor authentication

Any account that is used to access the metaverse should be secured with multi-factor authentication to provide an additional barrier to accounts being taken over. It’s also recommended that applications are downloaded and installed from official sources to reduce the prospect of malicious software being installed on your device.

The last thing any organisation wants is a cybercriminal posing as a legitimate member of their team.

Train your team

The most practical step for any organisation is implementing robust cybersecurity awareness training for all staff. In a blog post, the co-founder of Microsoft, Bill Gates, predicted that within the next two to three years, most virtual meetings will move to the metaverse. For businesses to safely operate in the metaverse, he said, it’s important to train staff well as “The weakest point in any organisation from a cybersecurity perspective is the user,”.

Here at Bob’s Business, we train your employees to be the heart of your cybersecurity and to protect your organisation through positive behaviours. Curious to learn more? Discover Bob’s Culture, our flagship cultural change solution which uses a Phishing Baseline and Awareness Questionnaire to determine your organisation’s blind spots and create your tailored course rollout plan.

How to spot a phishing email

Have you ever received an email that didn’t feel right? Like a receipt for an online order you didn’t place or a poorly worded email saying you’ve got money back from an annual tax return?

Don’t be fooled by their quirkiness; these are phishing emails, and they are a genuine concern, particularly those unaware of the threats they pose.

In a recent report, it was found that phishing and pretexting (a form of social engineering) represent 98% of social incidents and 93% of breaches, with organisations nearly three times more likely to be breached by social attacks than via technical vulnerabilities.

Recent reports have found that an astonishing 3.4 billion phishing emails are sent per day. Now that’s a lot of emails to avoid!

Spam filters are designed to do what their name suggests and block spam messages! However, according to research from Plymouth’s Centre for Security, Communications and Network (CSCAN), 75% of phishing emails without links and 64% of those with links made their way past spam filters and into the target inboxes. Even worse, only 6% of those emails were marked as malicious by email clients.

As we approach the end of 2022, 39% of UK businesses who have identified cyber attacks identified phishing attempts as their most common vector – A massive rise from 72% in 2017, to 83% to date.

Then it comes down to the person receiving the phishing email. They are the next and in most cases the last filter stopping unwanted intruders from breaking into your data.

So, what can you do to prevent you or anyone in your organisation from taking the bait? Here’s how to spot a phishing email, and how you can reduce organisational risk too.

How can you spot a phishing email?

As humans, we’re not always the best when it comes to judging risk. Some of us receive hundreds of emails a week, with many perfectly legitimate, which can lull each of us into a false sense of security, assuming that every email that we receive is to be trusted.

Making small changes to your habits so that you treat every incoming email with suspicion can make a significant difference when it comes to preventing a potential breach

7 signs to look out for when spotting a phishing email

The sender’s address doesn’t seem right

When you open an email, always check the email address of the sender first. If an email claims to be from a company you know, but the sender’s email address doesn’t match up, then that’s a sign something isn’t right.

Emails from addresses such as ‘1253628uwhdnwd@hotmail.co.uk’ or ‘info@amazen.co.uk’ are early telltale signs that the email is not to be trusted.

The email has poor spelling and grammar

When you’re reading an email, look out for any spelling or grammar errors, and also consider how well-written the email is. Official emails will usually contain no spelling or grammatical errors, typically because professionals wrote them. Criminals, however, tend to cut corners.

So, for example, if you receive an email trying to pass off as legitimate but it reads like this:
“Dear {{.FirstName}}

Someone has sent your an email uing Mail Lock the UK’s most scure email platform.
To see your mail, please, click here

This email link will expier 24 hours after you have redd this notification emai.
After this time the link message will be held securely until you get a replacement link messgae sent securly from the sender

Regards,

The Maillock Team”

Then you need to start asking questions!

The email has an odd use of imagery

Some phishing emails will often use attractive imagery and graphics such as photographs or company logos to make them look more like emails you’d get from a marketing team.
Remember to bare in mind, that just because the email contains nice pictures and looks like it’s laid out professionally doesn’t mean it might not be a phishing email.

Check the logos and images, if they’re blurry, of poor quality or look stretched out, that’s a dead giveaway that somebody has taken it from a quick Google search.

The email is designed to make you panic or make a hasty decision

Many phishing emails are designed to create a sense of urgency or make you panic, such as time-sensitive offers and situations that prompt you to act immediately and make impulsive decisions without thinking.

You might receive an email claiming to be from one of the systems that you use telling you that your account will be deleted if you don’t confirm your email address within an hour. This is a tactic designed to make you panic and throw caution to the wind.

Our research has found that combining a sense of danger with the appearance of an internal email can result in 94% click effectiveness, highlighting just how potent these psychological principles can be.

The email sounds too good to be true

“Good news. Having looked at your tax payments for 2018, you overpaid by £157. Click here to start processing your claim.”

At a glance, you’d probably think it was a nice quick win for your bank account.

Unfortunately, phishing emails usually offer attractive incentives like this so that you rush into getting your hands on it without a second thought. Whenever there’s an incentive in an email, always think twice. Remember, if it reads too good to be true, it probably is!

The URL you’re being linked to isn’t legit

Hiding a link in an email is easy. Some phishing emails will place links on bits of text or buttons so it doesn’t have to reveal a URL.

But you can check out where a link will take you by hovering your mouse over the text. Take note of the URL and ensure it matches the website you expect before clicking! If the URL doesn’t match, then it’s probably a phishing email.

For example:
Link Text: Click Here to Update Your Paypal Detail
URL: http://Paypals.com

Another good practice when checking the validity of a link is to look out for an SSL certificate at the beginning of the URL. This will show as https as opposed to just http. When installed on a web server, an SSL (Secure Sockets Layer) allows secure connections from a web server to a browser.

Check the company branding in the email

Phishing emails will try to mimic well-known brands to gain your trust and get you to let your guard down, whether you use those services or not.

If you receive an email from a company that you haven’t subscribed to, that’s probably because it’s a phishing email trying to impersonate that company.

You can easily catch these emails out by comparing them to ones you’ve received before from the company, do the logos match up? Are there glaring differences between the two?

What to do if you click on a phishing email

These are the steps that need to be taken after clicking a phishing link:

– Report the incident to your tech team as soon as possible

– Change login passwords

– Investigate the attack

– Inform the regulators and law authority

Take a look at some of our past blogs to learn more:

– What to do if you click a phishing link

– What are the different types of phishing?

– How to spot and prevent malicious emails

How does our phishing training help secure your organisation?

In a recent study, GOV UK found that cyber attacks were better avoided with gradual change within organisations, including communications via email, mock phishing exercises, conversations with specialist staff and informal and formal training. This means that staff are continuously kept interested in and alert to cyber threats.

Our award-winning Bob’s Phishing simulated phishing training is an effective way of teaching your employees about the dangers of phishing emails and how to avoid becoming a victim.

The simulated phishing campaigns allow you to evaluate the threat level phishing could pose to your organisation through the use of tailored phishing exercises and our engaging training courses and awareness materials that reinforce all the key learning points.
You can find out more about our phishing training here.