Employees still falling for phishing scams

30% of users will click on suspicious links, research finds

One third of employees are still likely to fall victim to phishing attacks, risking their company's entire network security, it has been found.

The figures come from Duo Security via one of its free tools, which it launched at the time of RSA conference in March 2016. 11,542 employees across 400 companies were put to the test by their IT teams, which sent out "phishing emails" to see who would fall for the trick. Of those recipients, 31% opened the link contained in the email - behaviour that, were it a real phishing email rather than a dummy one, could cause a data breach at the company they work for.

Advertisement - Article continues below

The fact that only a minority fell for the "scam", with two-thirds of those tested recognising the link as potentially malicious, isn't the point, according to Jordan Wright, R&D engineer at Duo Security.

"At the end of the day, what we see is that just one malicious email is needed for an attack to be successful," Wright told IT Pro. "31% may seem low, but in reality, it is still a lot of people." Indeed, in the case of these results, 31% is 3,578 people - an average of nearly nine per business.

Advertisement
Advertisement - Article continues below

Creating a phishing scam

Duo Security's Duo Insight tool was used by the 400 companies to send out the fake phishing email to their employees.

"We encourage IT administrators to customise the email as much as possible," said Wright, mimicking the targeted attacks often levied at businesses by hackers. This increases the likelihood that a recipient will open the email and click through.

Advertisement - Article continues below

That isn't the end of the scam, though. If the landing page then asks for credentials, users may smell a rat and decide to click away, rather than handing over their details. But, while users may think no harm will come to them if they haven't fallen for step two, that may not be the case in reality.

"This is a really big part of security," said Wright. "People think that if they don't enter their details, they are safe, but exploit kits can still download onto the computer without the user entering any information."

The point of this exercise isn't to catch people out or make them feel bad, though.

"The intent is for administrators to do two things. Firstly, to work out their strategies for dealing with potential phishing attacks and secondly to help educate the users," Wright said. This is more than just teaching them not to blindly click on links, but also, for the 59% who do not click, to encourage them to report an incident to IT, helping to nip it in the bud.

Duo Insight can be downloaded free in beta here.

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now
Advertisement

Recommended

Visit/security/355013/10-quick-tips-to-identifying-phishing-emails
Security

10 quick tips to identifying phishing emails

16 Mar 2020
Visit/business-strategy/mergers-and-acquisitions/354941/panda-security-to-be-acquired-by-watchguard
mergers and acquisitions

Panda Security to be acquired by WatchGuard

9 Mar 2020
Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/security/privacy/355155/zoom-kills-facebook-integration-after-data-transfer-backlash
privacy

Zoom kills Facebook integration after data transfer backlash

30 Mar 2020
Visit/infrastructure/server-storage/355118/hpe-warns-of-critical-bug-that-destroys-ssds-after-40000-hours
Server & storage

HPE warns of 'critical' bug that destroys SSDs after 40,000 hours

26 Mar 2020
Visit/software/355113/companies-offering-free-software-to-fight-covid-19
Software

These are the companies offering free software during the coronavirus crisis

25 Mar 2020
Visit/cloud/355098/ibm-dedicates-supercomputing-power-to-coronavirus-researchers
high-performance computing (HPC)

IBM dedicates supercomputing power to coronavirus research

24 Mar 2020