In our most recent report, Cybersecurity experts' views on email risk within Microsoft 365, we identify security risks that Microsoft 365 users face. We spoke with three experts to gain insights into some of Microsoft 365's key email security strengths and weaknesses.
This article features some key quotes from the report from Lisa Forte, Co-founder, Red Goat Cyber Security LLP; Robin Bell, CISO, Egress Software Technologies; and Jack Chapman, VP of Threat Intelligence, Egress Software Technologies.
Phishing is as prevalent as ever
People know about phishing. Users receive constant warnings of the signs. Examples include a sketchy email address, an unfamiliar greeting, or an urgent tone that plays on our fears. And yet, users keep falling for it. Our report, Fighting Phishing: The IT Leader's View, reveals that 84% of organizations were phishing victims last year.
When your organization falls victim to a phishing attack, searching for someone to blame is tempting. However, this is rarely helpful. Overall, it can lead to employees feeling disempowered and scared to make mistakes or report potential incidents because they're worried about the possible repercussions.
We are all human, and it's impossible to prevent people from making mistakes – especially when phishing attacks are becoming more sophisticated and challenging to spot.
"Unfortunately, phishing is as prevalent as ever," Jack Chapman explains, "The worrying trend is the continued automation and rising sophistication levels of these attacks. This is primarily caused by a maturing Crime-as-a-service ecosystem, where criminals have access to better resources, training, and compromised accounts to launch their attacks."
Security awareness training has remained popular, but it's clear that IT leaders are dissatisfied with it. While 98% of organizations deliver anti-phishing training, 45% switch providers each year, and 72% switch providers every three years. That suggests something is missing from employee training and that it isn't as effective as leaders would like it to be.
COVID created opportunities for organized crime groups
The Covid-19 pandemic has fueled a substantial increase in organized crime. Last year, the Internal Revenue Service (IRS) warned that there had been a notable increase in bad actors. Most notably, those trying to steal stimulus payments and filing fraudulent claims for unemployment compensation using the stolen personal information of people who had not filed claims.
"I've seen a huge increase in phishing emails and SMS messages over the past year." Lisa Forte says, "Covid played a major role in this, firstly because of the uncertainty it created and secondly because of the amount of e-commerce it drove."
"The latter means we constantly had deliveries, online vaccine bookings, and notifications about social distancing all sent to us with links." Forte continues, "We became desensitized to seeing Zoom links and SharePoint links to things we needed for work as we'd moved to the cloud. All these things present huge opportunities for attackers. Covid was probably the best thing that could have happened to organized crime groups."
Training and effective software can help to reduce phishing attacks
Not every organization has noticed the increased level of phishing attacks. "Speaking as CISO of Egress, I haven't," Robin Bell says when asked if he has seen increased phishing incidents over the past year.
"Although we are in a relatively unique position compared to most companies due to two reasons. Firstly, we, of course, use Egress Defend, which is highly effective in reducing phishing risks," he says.
Egress Defend is designed to protect against phishing threats by reducing human activated risk. It does this by providing real-time teachable moments to users at the point of risk, educating them about potential threats, and empowering them to report emails that appear malicious.
"Secondly, we have a very mature training and awareness security program that not only trains but tests our colleagues on a random basis. Being in a cybersecurity company focusing on this marketplace means all colleagues are probably more aware of phishing than other organizations might be," says Bell.
To reduce the chance of possibly falling victim to these attacks and protect against outbound risks, many organizations choose to augment their Microsoft 365 defenses.
You can download our report to learn more about augmenting your Microsoft 365 defenses and access the full range of insights from these experts.