Despite decades of iterations and advances in security protection, phishing has been around since the 1990s. According to IBM Security X-Force’s recently released Threat Intelligence Index, phishing remains the most common means by which attackers gain access to victims’ networks. 41 percent of the attacks X-Force stopped last year used phishing tactics. This covers all types of phishing, including mass emails and highly targeted emails.
In fact, even the most technologically advanced attackers in the world will try to use phishing to plant ransomware, malware, remote access Trojans or malicious links before launching an attack campaign, and attackers will carefully study the target company’s website and social media accounts. The Attackers can use this information to build targeted fraudulent content.
Some experts say that phishing remains popular with attackers because it is both simple and efficient. “Phishing attacks are becoming more sophisticated, attackers are improving their capabilities and attack tools, and they are targeting in more organized, innovative and clever ways.”
The rise of the telecommuting model provides opportunities for telecom attackers. In the era of remote and hybrid working, businesses rely heavily on email, and attackers are sending more emails to exploit this weakness of the business. At the same time, this office model makes it impossible for employees to alert each other in person of potentially suspicious emails in each other’s inboxes.
Cybercriminals are constantly upgrading their phishing scams. Attackers have long discovered that by manipulating the psychology of employees they can increase the success rate of phishing attacks. When phishing emails are sent along with a double baiting of the target by phone or SMS, the click- through rate of phishing emails rises to 53.2%, a figure that is three times higher than the click-through rate achieved by mass phishing emails. People may even click on the emails knowing that they are very suspicious, but they cannot resist their curiosity.
Dark web black market organizations are becoming more and more sophisticated and professional. Today’s attackers no longer need to develop their own fraud scripts or prepare a specialized set of technical tools, as these needs are well met on the dark web black market, where cybercriminals can buy any type of phishing instruction kit.
Insufficient innovative approaches to employee security awareness education. While email scam tactics are becoming more advanced, employee security training has not kept pace with the changes. Many companies provide annual security training to employees, but simple lectures and quizzes are of very limited value. ” You can patch a computer, you can patch a server – but trying to patch it alone is hard, and perhaps a more radical approach to security education is needed.”
In fact, the reasons described in the above report have long been agreed in the industry, especially the level of employee safety awareness education, which has been frequently mentioned in the industry, but this still cannot prevent the frequent occurrence of phishing email attacks. In response to this problem, in order to develop a good safety awareness among enterprise employees, we should not only rely on preaching, but should conduct a complete simulation exercise test, which is what we often call actual combat drills. Moreover , employees in different positions have different abilities to identify phishing emails. Some low-level phishing attacks can be identified by employees in technical positions at a glance, but for non-technical employees, it is usually difficult to assess whether similar emails have other malicious purposes. This passage means that even if we do safety awareness education, we must focus on different types of employees.
To stop phishing emails businesses should explore more ways .
The report, released by IBM Security X-Force, also offers its own recommendations on how to organize phishing attacks, noting that phishing emails are just a precursor to a cyber attack. Quickly deploy next-stage attacks, such as ransomware or data theft. Data breaches caused by phishing scams cost companies an average of $4.65 million, according to the cost of data breach reporting.
Unfortunately, there is currently no single tool or solution that completely blocks all phishing attacks. IBM Security X-Force recommends a layered approach, starting with security solutions that filter malicious messages, such as zero-trust security.
A zero-trust security solution will prevent attackers from penetrating the system by continuously verifying the user’s identity and minimizing the number of people who can access valuable data assets. Having a proven Zero Trust strategy can save money in the event of a breach. According to the Cost of a Data Breach report, organizations employing this strategy spent an average of $1.76 million less than organizations that did not use Zero Trust.
No matter what strategy is used to protect enterprise security, the most important point is not what type of security products are purchased, but the actual use of security products. Don’t just buy a security product, plug it in, and put it aside. Attackers are becoming more sophisticated and they are learning how to counteract all the techniques used to defend against it, so it is important to continuously test current security measures and dynamically adjust to the attacker’s mind.
How should enterprises ensure data security?
The establishment of two or more sets of IT systems with the same function in remote locations, capable of monitoring the health status and switching functions, is referred to as disaster recovery. When one system fails due to an accident (such as a fire or an earthquake), the entire application system can be switched to another location so that the system functions can continue to function normally. Backup and disaster recovery are two distinct concepts.
The goal of disaster recovery is to ensure the normal operation of information systems in the event of a disaster and to assist enterprises in achieving the goal of business continuity. Backup is used to address the issue of data loss caused by a disaster. Prior to the introduction of integrated disaster recovery and backup products, disaster recovery and backup systems were separate. The ultimate goal of disaster recovery and backup products is to assist businesses in dealing with human error, software error, virus invasion, hardware failure, natural disasters, and other issues.
Backup data on a regular basis to ensure business continuity. Only in this manner can the system be restored in time and business continuity ensured in the event of disasters or human errors.
How to choose an affordable and robust vm backup solution?
Vinchin Backup & Recovery allows you to recover the entire VM and all its data from any restore point (full backup, incremental backup, or differential backup) without affecting the original backup data. Backups that have been deduplicated or compressed can be recovered. It is an excellent solution for ensuring enterprise business continuity and minimising critical business interruptions caused by disaster or system failure.
You can also quickly validate backup data availability by instantly restoring the target VM to a remote location in a matter of minutes. Ascertain that, in the event of a true disaster, all VMs can be recovered and that the data contained within is not lost or damaged. Vinchin provides solutions such as VMware backup for the world’s most popular virtual environments, XenServer backup, XCP-ng backup, Hyper-V backup, RHV/oVirt backup, etc.