this is susan bradley for cso online well it's the new year and it's time to review some fundamental
issues that we still have in technology fishing it's a daily risk to any organization over the
last year i've noticed for that the small to medium-sized organization organizations
we've done a better job in reacting to vulnerabilities into zero days and as a
result the attackers have pivoted to different attack methods rather than attack us through our
systems attackers attack us through remote control tools through our consultants and most importantly
through our users via phishing attacks companies have attempted to patch the human by
using fishing simulations but often i've seen examples of less than ideal and certainly less
than ethical ways to run fishing simulations a certain vendor got into trouble just the other day
for insensitive phishing email offering bonuses to their employees during the christmas season
obviously it didn't go over well too many of us still reuse
passwords over and over again in the same websites so it's important to educate users not only on
phishing attacks but on the types of things that these attackers are wanting to get those
credentials someone once said to me attackers no longer crack or hack into sites they log in
because they have the credentials already we enter 2021 with a bit of a tipping point in credential
management for many years the standard process we used to protect our credentials was to change them
often michael mcintyre a british comic talks about choosing passwords and how we would start with a
special word then we capitalize that first letter of that special word and then we'd add a special
character to the end of the word as our password and that was our perfect password and we'd use
it everywhere now we're pivoting to passwordless solutions and two factor authentication to better
protect our accounts you want to educate your users that attackers target them based on themes
and behaviors we started the year of 2020 with attackers pivoting to fishing lures based on covet
19 themes from enticing headlines and indicated information from the world health organization to
lures regarding personal protective equipment the attackers knew that what was in the headlines was
what we were searching for as the year progressed we pivoted to other headline grabbing events such
as racial riots black lives matters protests and even i've seen at the end of the year believe
it or not pivoting to christmas news educate your users and your administrators to having
a trusted set of links information that they know are proper and they can click on with no issues at
all especially for your administrators if you're like me and microsoft 365 is one of your tools
in your arsenal you go to a lot of places and a lot of 365 links and sometimes you have to build
yourself a cheat sheet in order to make sure that you go to the right link because merely googling
isn't going to cut it anymore microsoft's office 365 security and compliance attack simulator
is moving to a new location on january 18 2021 instead of the old url at protection.office.com
it's moving over to security.microsoft.com on this new location you have attack simulation training
and various different techniques that you can try so you can do simulation and malware test detects
you can choose different payloads different automations
and actually see the impact on your organization you can choose specific kinds of tests
credit cards capital one
coven 19 shipment tracking docusign review etc etc so you can choose one and actually target it
for your organization and the types of emails that they normally get so educate your users to hover
over links before clicking even if you have link filtering enabled either in your email software or
in your firewall ensure that your users know how to review links and emails i still see ones wiggle
in and get through my defenses so take the time to educate your users make sure they know that they
too are part of your security process as i always say patch the human it's hard it's difficult
it's not perfect but sometimes it's your best line of defense as always check out all of the
videos on the idg tech talk youtube channel until next time this is susan bradley for cso online