Penetration Tests are Indicating Worse Cybersecurity Postures Across Globe; Phishing Attacks are Topping the List

The effectiveness of data protection measures and the utility of available patches have worsened in recent years. The Cymulate Cybersecurity Effectiveness Report 2022 highlights that the overall data exfiltration risk score has become poor, with cloud service-related evaluations standing at an average score of 70, while network protocols have a moderate risk score of 43. 

Phishing attacks are responsible for almost 90% of data exfiltration or breaches. There’s no doubt that companies are investing in cybersecurity protocols and applications; however, they are lagging in securing the basic loopholes, and attackers are sidestepping modern technical protections. 

Popular Clouds are More Susceptible

Earlier threat actors used file-sharing services like Dropbox and Box, but now their malicious attachments don’t pass filters and other security technologies. That’s why they have shifted to using more generic cloud infrastructure, like Amazon and Azure. This shift is standing as a challenge for businesses as it’s not easy to block data from trusted service providers, as they are the driving force behind many large cloud services and websites.

These metrics are applied to numerous attempts aimed at extracting data categorized as ‘controlled’ from the organization. This upsurge signifies that organizations are facing greater difficulty in preventing the unauthorized removal of business-confidential, personally identifiable, and other controlled data from their systems.

Phishing Instances are Going Out of Hands Now!

Since the fourth quarter of 2022, there’s been a 1,265% increase in malicious phishing emails and a 967% rise in credential phishing.

Phishing is a type of social engineering attack where a cybercriminal poses as someone you know and trust to manipulate you into giving up sensitive details, transferring money, taking an action they desire, downloading a malware-infected file, etc. 

Nowadays, with the help of readily available phishing kits and generative AI-based tools like ChatGPT, it has become easier to create phishing emails and instant messages that are devoid of mistakes that are considered red flags or warning signs. This means that now emails don’t have poor grammar, irregular sentence formation, unprofessional tone, etc. 

Unlike scams like ‘The Nigerian Prince,’ where the emails were written in broken and unreadable English, these days, scammers are developing content that is as sophisticatedly drafted as the high-paying professional writers sitting in your team do!

What’s worse is that even The Nigerian Prince scam is back in action, and it’s also being driven by AI.

In fact, as per Recorded Future, numerous cybercriminals have started sharing malware, social engineering tutorials, money-making schemes, etc., on the dark web, and ChatGPT drives all of these.   

Phishing Penetration Testing Can Save You

Phishing risk tests or phishing simulations or phishing assessments are cybersecurity measures where ethical hackers or pen testers simulate a phishing attack to evaluate how good you and your team are in identifying and responding to such attacks. 

Image sourced from hackernoon.com

White hat hackers mimic real-world phishing tactics to manipulate targeted employees into sharing sensitive files and information like passwords, financial details, operational strategies, or transferring money. The message is made to appear to be coming from a colleague, senior employee, CXO, third-party service provider, bank, etc.

Conducting phishing tests assists organizations in pinpointing vulnerabilities, gauging the efficacy of training programs, ensuring compliance, and mitigating risks. This practice aids businesses in enhancing their cybersecurity measures, safeguarding assets, and upholding their reputation through the prevention of data breaches.

How is Phishing Penetration Done?

A simulated phishing penetration test is done in two stages:

Stage 1: Baseline Pishing Penetration Testing

This is done by simulating an ethical phishing email that is sent to all the employees of an organization without intimating them in advance. Then, the number of employees who clicked on the malicious link, shared sensitive details, or took any other action is recorded and reported. 

This creates a baseline for cybersecurity for the organization and reflects whether employees need awareness training or not.

Stage 2: Advanced Phishing Penetration Testing

A pen tester evaluates the efficacy of security programs by:

• Checking firewall rules and proxy servers.
• Evaluating how many devices and software are unpatched despite the patch being available.
• Assessing the patch management policy.
• Testing the quality and efficacy of antivirus and antimalware installed across devices.
• Evaluating the number of employees and devices vulnerable to phishing attacks. 

How Can Organizations Control the Instances of Exploitation of Email-Sending Domains?

Threat actors often exploit a reputed organization’s email-sending domain to send phishing and spoofing emails. Since these domains have a good reputation, the email delivery rate is higher, which means the probability of the recipient engaging with a fraudulent email is also higher.

So, what eventually happens is that the recipient ends up being a victim by either sharing confidential details or transferring money. Since your official domain is involved in the attack, you become liable to lawsuits and other consequences due to your inability to protect your domain. 

Now, on the brighter side, you still have the option to protect your domain from getting exploited by deploying SPF, DKIM, and DMARC. These three email authentication protocols instruct recipients’ servers to either mark potentially fraudulent emails sent from your domain as spam or outrightly reject their entry. 

We at DMARCReport assist in DMARC reporting and monitoring, which allows you to catch insights on your domain’s email activities. Evaluating these insights helps adjust policies and other settings to ensure our clients are safe from getting their reputations, finances, and operations compromised by bad actors. 

Please feel free to book a demo today to learn more about how we can help you and your online business reputation.