Email attacks have been one of the top methods of attacking users online for years. Many people think they won\u2019t fall victim. However, these attacks haven\u2019t stopped\u2014they continue each year because they\u2019re successful. Today, we\u2019ll talk about some of the reasons why these threats succeed and what you can do to help prevent them.<\/p>\n
In sales, numbers become predictable over time. For a given salesperson, they may know that out of every 10 customers they call, they can expect to close one or two. If they want to hit their quota, they make a certain number of calls and they know that, on average, they will hit their quota.<\/p>\n
The same applies to phishing. A small percentage of people will fall victim to a phishing scam. Perpetrators need only send out a lot of emails, and a few people will click. This can make any given phishing campaign profitable. Plus, emails can be low cost to send and don\u2019t usually require a ton of technical know-how to pull off.<\/p>\n
Additionally, criminals can improve their success rates by doing some reconnaissance. In some cases, it could be a sophisticated\u00a0spear-phishing attack<\/a>\u00a0targeted at an executive using information they gleaned using open source intelligence techniques. Or it could be simpler\u2014they could email blast an organization with an email that appears to come from the personal email of the CEO with an \u201curgent request.\u201d Either way, these can improve their success rate and make them even more successful with their email campaigns.<\/p>\n User security training is essential for reducing your customers\u2019 email security risks. It\u2019s important to teach users what to look for in spam or phishing emails, like misspellings, out-of-character requests, or time pressures like being asked to approve an invoice within an hour.<\/p>\n However, email attacks can succeed despite this because training doesn\u2019t always lead to behavioral change. Employees may zone out during in-person trainings. Others may need to receive information in a specific way\u2014written, visual, or hands-on training. Many employees won\u2019t retain the information for the long term. Training can reduce the overall risk, but it\u2019s not a silver bullet.<\/p>\n Note:\u00a0<\/b>You can further reduce the risk a customer will forget important information by offering them follow-up resources like an infographic, poster, or email send that reiterates the important points from your user training. Periodic refreshers can also help.<\/p>\n Perhaps one of the biggest factors in successful phishing attempts is attention. This focuses on two dimensions.<\/p>\n First, people pay attention to relevant information. If the news is dominated by a major story, a scammer can exploit this natural curiosity to hook peoples\u2019 attention. For example, if the government offers a new home loan program and it\u2019s widely publicized, scammers can use this information to trick people into giving away important personal information or user credentials to learn more. People are already primed to pay attention to a relevant email, so scammers can often take advantage.<\/p>\n Second, people often have moments of split attention. When this occurs, people have their guards down, making them less likely to recognize a scam. For example, imagine a manager at a small business who just finished an exhausting project, had to have a sensitive conversation with an employee earlier, and has been pinged by text messages from their family all day. If they have to sort through dozens of emails before they can close their laptop for the day, they\u2019re likely emotionally drained enough to miss a few details. That error could be costly, but it\u2019s certainly human.<\/p>\n Ultimately, phishing scams work because humans make mistakes. You can reduce their risk by offering strong user training, but one or two people in an organization may forget that training when they need it (although, this is no excuse not to offer security training). And of course, it only takes one or two clicks in an organization to potentially cause a breach.<\/p>\n That\u2019s why you shouldn\u2019t rely on any one tool to fight back against cybercriminals. Instead, it\u2019s important to use multiple layers\u2014even within your own email security\u2014to help prevent these attacks from taking hold. Humans need to continue doing their part, but technology should play a role.<\/p>\n For instance, it makes sense to add an additional email security gateway on top of any existing email program your customers use. While many email programs offer some level of security, it\u2019s often insufficient\u2014adding another check on top can go a long way toward reducing the overall number of threats reaching individuals\u2019 inboxes. This means your security can rely less on fallible humans.<\/p>\n Additionally, it\u2019s important to realize that email usually represents only one phase of an attack. Having other security layers in place like endpoint protection to detect malware and fileless attacks, backup for restoring data if it gets encrypted, and frequent patching can help you round out a security strategy for your customers.<\/p>\n Ultimately, phishing attacks continue because they succeed and are profitable for cybercriminals. Yet, if you have the right technology in place to supplement the human element, you can help greatly reduce your customers\u2019 risks.<\/p>\n One of the best ways to help reduce email attacks is to have a strong\u00a0email security solution<\/a>\u00a0in place. SolarWinds\u00ae<\/sup>\u00a0Mail Assure is built to help MSPs protect their customers from email attacks. It uses collective intelligence from its entire user base to protect customers against even emerging attacks. For example, if some of its user base sees a specific scam occurring based on a news event, it can flag that and help prevent it from reaching the inboxes of other users. Additionally, it\u2019s compatible with nearly any email solution including Microsoft 365. Learn more by starting a\u00a0free trial today<\/a>.\u00a0<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":" Email-based attacks have been with us for a long time. This blog looks at how MSPs can help their customers make sure they are prepared.<\/p>\n","protected":false},"author":24,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"class_list":["post-6050","post","type-post","status-publish","format-standard","hentry","topic-security"],"acf":[],"yoast_head":"\nLack of training retention<\/h3>\n
Attention<\/h3>\n
Prevention<\/h3>\n