Phishing attacks: Do they really work?

Yes, phishing attacks still work — despite being one of the earliest cyberattack techniques.

An estimated 3.4 billion phishing emails are sent every day, and Google alone blocks around 100 million of them daily.

• Phishing accounts for 36% of all US data breaches, with business email compromise attacks costing victims over $3.18 billion.
• 83% of UK businesses that suffered a cyber attack in 2022 were victims of a phishing scam.
• 74,500 phishing incidents were reported in Australia in 2022, making it the most prevalent form of scam in the country.

With the average cost of a data breach skyrocketing to over $4 million, organizations must take steps to protect their data and infrastructure.

As an MSP, how can you help your clients improve their security postures and strengthen their defense against phishing attacks? Here’s what you need to know.

Educating your clients: What is phishing?

You’re probably familiar with the term phishing. However, your clients may ask, “What is phishing, and why should I care?” Educating your prospects and customers is essential for helping them understand the value you deliver and how you can help them stay safe. So let’s get onto the same page:

Phishing happens when attackers trick users into clicking a link to download malware or visiting a spoof website to enter their credentials. Hackers can then sabotage systems and steal intellectual property, customer data, or money. While some criminals send phishing messages via text or social media, phishing emails are the most common because they can reach millions of users in one fell swoop.

There are different phishing techniques. Besides mass campaigns, more criminals now favor spear phishing or whaling phishing — using specific information about high-value individuals to craft persuasive and realistic messages. One recent whale phishing attack cost an organization $47 million.

How to mitigate phishing attacks with a layered approach

There’s no single magic bullet to prevent phishing scams. No matter how careful a client is, attacks will get through, and you must be prepared to detect intrusions promptly and minimize damage. A layered defense approach allows you to widen your defense from relying on users to spot phishing emails and reacting to incidents to incorporating technical measures and proactively building resilience.

Your strategy should contain these 9 critical components:

Implement email filtering and blocking

If a client uses a cloud-based email provider, switch on the email filtering/blocking function by default for all users. If a client hosts an on-premise email server, use a filtering/blocking service and configure the rules to meet the organization’s security requirements.

Audit publicly available information

Guide your clients to develop a digital footprint policy, especially for high-profile members of the organization, so threat actors can’t use publicly available personal or professional information to launch spear phishing or whaling attacks.

Protect devices from malware

Help your clients properly configure all endpoints to prevent malware from being installed onto employee devices. Also, monitor endpoint activities and implement a robust intrusion detection solution to prevent attackers from gaining a foothold in your client’s systems.

Ensure effective authentication and authorization

Make the login process resistant to phishing, such as turning on multi-factor authentication (MFA) and implementing single sign-on (SSO). Also, enforce access control and limit the number of people with privileged access to minimize lateral movement.

Use password managers

Besides supporting a strong password policy, password managers can help employees recognize real websites because the software won’t autofill on fake ones. They make it easier for users to spot suspicious websites by making manual password entry an unusual request.

Perform regular vulnerability scanning

Take a proactive approach to protect your clients from malware introduced via phishing attacks by identifying and remediating potential vulnerabilities. For example, inSOC’s vulnerability management solution performs weekly scans to ensure all security and network controls are up-to-date.

Implement 24/7/365 monitoring

Monitor all network activities and analyze security logs to identify suspicious activities. A SOC as a Service (SOCaaS) solution supported by an AI-driven extended detection and response (XDR) platform allows you to process vast amounts of real-time data to support prompt mitigation.

Design an Incident Response Plan

Once an incident is reported or discovered, your team must know exactly how to minimize damage. For instance, a response plan should detail how to force a password reset or remove malware from a device.

Adopt the right approach to employee training

Many organizations have a counter-productive attitude by punishing employees who fall prey to phishing campaigns. However, it discourages people from reporting issues so the security team can respond promptly to minimize damage. Instead, help your clients encourage employees to report incidents.

A layered defense approach in action

Here’s an example of how the various components of a layered defense work together: