Phishing attack / social engineering attack
Understanding the most significant threat to enterprise information security
Definition
Phishing is an online attack method based on social engineering, in which attackers impersonate a trusted party in order to steal sensitive information such as passwords and credit card details, or to cause malware to be installed. The term derives from the English word "fishing", since attackers "cast a lure" and hope the victim will "bite".
Types of phishing attacks
Email phishing
The most common type - sending emails that impersonate legitimate organizations such as banks, delivery companies or cloud services.
Spear phishing
Attacks tailored to a specific person or organization, based on in-depth research of the target.
Whaling
Attacks aimed at senior executives (CEO, CFO) who have access to critical information or authority to transfer funds.
Smishing - SMS phishing
Attacks via text messages (SMS) that contain malicious links or requests for information.
Vishing - voice phishing
Using phone calls for social engineering and to extract sensitive information.
Clone Phishing
Copying a legitimate email and replacing links or files with malicious versions.
Warning signs for recognizing phishing
- 1A suspicious email address, or one similar to a legitimate source
- 2Artificial urgency: "Act now or your account will be locked!"
- 3Spelling mistakes and poor wording
- 4A request for sensitive information (passwords, credit card numbers)
- 5Suspicious links - hover over the link to see the real address
- 6Unexpected attachments
Worrying statistics
of breaches in organizations begin with a phishing attack
of organizations experience at least one phishing attack a year
The average cost of a data breach in an organization
The average time until an employee clicks a phishing link
How do you protect the organization?
Awareness training
Ongoing training of employees to recognize threats
Phishing simulations
Controlled exercises that imitate real attacks
Two-factor authentication
An additional layer of security beyond the password
Email filtering
Systems that detect and filter suspicious emails
Security updates
Keeping systems updated and protected
Reporting procedures
Clear processes for reporting suspicions
The conclusion
Phishing is a real and constant threat that keeps evolving. The most effective protection is a combination of advanced technology and aware, skilled employees. Regular phishing simulations are the best way to prepare your organization for the real threat.
* One allowlisting action by your IT team is required, and launch is subject to a security review of up to one business day.