A new study suggests that phishing and social engineering are the leading methods of compromise in corporate network environments.
The report, carried out by Illinois-based cybersecurity business Trustwave, suggests that human error in the wake of a social engineering attack most threatens business security.
Social engineering occurs when hackers pose as an authority, tricking unsuspecting targets into divulging personal information, passwords, or access to files and networks.
Hackers may send emails which appear to be from an employee’s boss in order to gain information.
Phishing, a popular form of social engineering, specifically involves creating an imposter website which collects the username and password as a user attempts to log in.
The report says that ‘CEO fraud’, a form of social engineering which encourages executives to authorize fraudulent money transactions by posing as the company CEO, continues to increase.
CEO fraud is carried out one-to-one by con artists, who target specific companies and employees.
The report says “…the message appears to originate from the CEO’s account, but the Reply-To message header is set to a different account to ensure that replies or follow-up messages from the target reroute to the scammer and not the CEO.”
Trustwave report that another common method of attack when targeting hotels and restaurants last year was telephone-initiated phishing.
This method involves the attacker calling to complain about being unable to make a reservation on the victim’s website. They ask to email their details to a staff member who then opens the expected email which has a malicious file attached.
One of the lesser-known threats to corporate networks is ‘malicious insiders’. These include current and former employees with the credentials to intentionally cause damage to a business or breach its security.
Thirteen per cent of attacks, an increase since the last report, were the result of malicious attackers.
The full report can be found on the Trustwave website.