For Cyber Awareness Month, the American CISA (Cybersecurity & Infrastructure Security Agency) has defined four educational topics for discussion. These are under the “See Yourself in Cyber” theme, meaning they are under individual responsibility and possible to attain though awareness and practice.
Here are the topics:
- Recognize and Report Phishing
- Update Your Software
- Use Strong Passwords
- Enable Multifactor Authentication
Every week this month, we’ll cover each of these topics in an article, starting with Recognizing and Reporting Phishing.
Why Recognize and Report Phishing?
As important as knowing the signs of a Phishing email is, just deleting it is a solution that doesn’t solve the problem in the long run. Reporting a phishing email allows it to be flagged, preventing others may fall victim to this attack.
Individually, personal email providers add phishing message reports to blocklists, making it possible for other users not to receive the emails. Governments use scam reports to track patterns and take down gangs.
For corporations with robust reporting solutions, an employee who reports an email makes it possible for admins to investigate the message further and quarantine the same message on all other corporate inboxes.
For organizations, phishing attacks happen on several inboxes at once, so reporting becomes essential because it only takes one successful phishing email to open the door to ransomware, for example. Reporting prevents a more powerful attack.
So, recognizing phishing is important, but teaching individuals in homes and offices to report phishing threats is essential to ensure the safety of organizations and nations.
Recognizing Phishing: the role of Phishing Simulations
Phishing simulations are an inseparable part of teaching employees how to recognize phishing. Although teaching them the signs of a phishing email is a necessary component, the theory will never replace real-life simulations.
That happens because phishing attacks count on employees dealing with hundreds of emails daily, and they don’t have the time to analyze each message carefully. The role of a simulation is to train their instincts in the middle of this daily flux and make them more aware without disrupting productivity.
Also, simulation and training are a cycle. Here at Right-Hand, we believe that action prompts action, and employees who fail at simulations uncover opportunities to learn. That’s why we connect our simulation with short but direct training modules aimed at sharpening their phishing awareness.
Reporting Phishing: Quick and Easy, so it Becomes a Habit
Reporting phishing is something so vital that it should be part of every employee’s job description. However, as important as it is, it’s not their core job, so it can’t disrupt their other activities.
We see a lot of organizations with informal reporting methods that make the employees’ work difficult and time-consuming, such as email, internal communication, and even phone calls. These require that the user explain the issue, forward the message, and take one too many steps to perform the simple act of reporting the suspicious email.
And it’s not easier for admins: with informal channels, they have trouble organizing queues, investigating suspicious messages, and mitigating threats in bulk when they get a positive on a phishing message.
Therefore, a proper reporting tool (like Right-Hand’s PhishArm) offers users the ability of one-click reporting. That means that it takes the blink of an eye for them to get rid of a suspicious message, communicate directly with their admins, and go back to their tasks without friction.
On the admin side, they receive the reports in an organized queue and complete half their work through automated analysis of the primary markers of a phishing email.
For further convenience, admins can use an email quarantine tool (such as our EQA) to mitigate threats in all inboxes at once.
Final Words
For organizations, recognizing and reporting phishing may be the difference between business continuity and tens of millions of dollars in damages. But more than that, enabling employees to be aware and giving them the knowledge to identify and help mitigate threats before they harm creates a positive organizational culture.
How so? Many organizations still operate under the policy that they do not consider themselves the target of cyberattacks, and when they are, they blame employees. The impact of a punitive culture in the organization has consequences that reach way beyond just cybersecurity. Losses caused by lower morale are hard to measure but still devastating.
Investing time and resources into prevention and knowledge about phishing threats is a good call for security and long-term culture.
