Whether or not a company’s workers are truly its weakest link is an arguable point, but a recent study found that a determination can be made whether or not a particular person may be targeted with a fraudulent email.
Factors like whether or not a person’s login credentials for other websites had been compromised due to an earlier data breach and were available for sale on the dark web and even how old a worker is play a large role in deciding if a worker is a potential problem, according to a study by Panorays. The concern being many people use the same credentials for multiple accounts or just vary a set number of credentials slightly making them easy to brute force.
Panorays said by drilling down through these, and a few other facts, they can generate a list of people most likely to be singled out in an attack by determining their overall digital footprint.
This is particularly true if the employee is older, not because they me less cybersecurity savvy, but simply due to the fact they have spent more time online and thus had a greater chance to have their credentials stolen and then used against their current employer, Panorays said.
A separate Proofpoint study of the issue found individual contributors and low-level management workers were targeted 72 percent of the time in phishing attacks, and production and operations were the most targeted departments absorbing 22 percent of all attacks with sales being hit 14 percent of the time and management 13 percent.
Hackers are also interested in getting the most bang for their buck with Proofpoint finding that 30 percent of phishing attacks target generic corporate addresses, such as [email protected] or [email protected], which normally reach multiple people in a single company helping to increase the attack surface through a single email address.
Proofpoint also found that organizations that were targeted by email fraud 40 percent received more 50 phishing emails, a four-fold increase over last year.
