Phishing still major attack vector of successful data breaches— KnowBe4 Report
The 2019 KnowBe4 African Report based on data from South Africa, Kenya, Nigeria, Ghana, Egypt, Morocco, Mauritius and Botswana, has found that people living on the continent are not prepared for the cyber threat.
Besides, the report revealed that email security is one of the biggest threats facing the average user, both at work and at home, and it is one of the most common communication methods — more than 70% of those surveyed use email to collaborate with friends and colleagues.
Most people don’t realise what a risky email looks like or how their actions can result in their systems becoming infected. While more than half of respondents in Botswana, Egypt, Kenya, Ghana, Morocco and Mauritius have enough security smarts to avoid clicking on links or opening attachments they don’t expect, a startling 46% still trusted emails from people they knew. In South Africa, those statistics are completely turned around – more than half of respondents (52%) trust emails from people they know, while only 49.5% don’t open attachments they have not expected.
Otherwise, email remains one of the most successful forms of cyber attack today for this very reason. People are quick to click on links or attachments sent to them from people who they know, not realising that cyber criminals have potentially hacked or spoofed (impersonated) their friend’s, colleague’s or suppliers’ systems to spread malware, or launch other forms of attacks.
Cyber criminals can easily mimic contact lists or use email addresses that look as if they’ve come from trusted institutions, and a simple click can unleash a ransomware attack that can hold an entire company, government or home hostage. According to Verizon’s 2019 Data Breach Report, email phishing is till the number one attack vector used in successful breaches. Closely followed by malware infections and the use of stolen credentials – both of which are attack vectors commonly accomplished via phishing. Phishing and social engineering attacks are not just limited to email – they have spread to other communication channels such as WhatsApp and the phone. With WhatsApp use at more than 90% in Africa, this is a serious concern.
Also, another myth around phishing scams is that they are badly written with terrible language and rude offers. While these still exist, they are no longer the norm. Cyber criminals have become incredibly sophisticated and prey on this lack of understanding. Across all eight countries, more than a quarter of respondents checked for bad grammar and spelling to determine whether or not an email was legitimate. Interestingly, more than a quarter had also clicked on a phishing email.
It turns out that yes; Africa has been phished and will continue to fall prey to this insidious attack unless they recognise the need for training and a deeper understanding of security threats.
When looked at against the backdrop of how often they’ve been caught by a phishing email, it’s clear that users still don’t realise how easily they can fall prey to a well-designed email.
The biggest concern is that this lack of awareness around cybersecurity impacts a person’s life, identity and work. Humans are one of the most common causes of a business being held by ransomware or crippled by malware, data breaches or plain financial fraud. Their inadvertent clicking on an attachment, sharing personal information or carrying an infection into work on their mobile device can cause these types of issues.
On the way out of attacks and buffers, the report said “For organisations, it has become critical that they train employees around security best practices and the various methodologies used by the cyber criminal.
“People need to stop thinking that phishing and ransomware only happen to other people or big businesses – everyone is vulnerable. One of the reasons why spam continues to rise in quantity is because it works often enough to be of value.
According to the September 2019 Cisco Talos Email and Web Reputation Centre report, the average spam volume for the year was 409.51 billion. That’s compared with the paltry 68.90 billion emails that are legitimate. Spam works because somebody always clicks on the link.
Accordingly, the report agreed that training in cybersecurity threats, methodologies, entry points and vulnerabilities has become critical for organisations as it would not only help to minimise the growing risk of human error that’s allowing threats to bypass their complex and powerful security systems, but helps to protect their employees.
