![\"1.](\"\/wp-content\/uploads\/2020\/10\/75034c513ef3ce93bc27afe604afdba1.JPG\")
<\/p>\n<\/p>\n
Today, a network administrator or cybersecurity engineer spends a considerable amount of time and effort protecting the enterprise's network perimeter from various threats, mastering new intrusion prevention and event monitoring systems. However, even this does not guarantee complete security. Social engineering is actively utilized by criminals and can have serious consequences.<\/p>\n
How often have you caught yourself thinking, \"It would be good to conduct a literacy check for staff regarding cybersecurity\"? Unfortunately, these thoughts often hit a wall of misunderstanding in the form of numerous tasks or limitations of the workday. We plan to tell you about modern products and technologies in the field of automation for staff training that won't require extensive preparation for pilots or implementation, but let\u2019s go one step at a time.<\/p>\n
Currently, more than 80% of malicious files are distributed via email (data taken from Check Point's reports over the past year using the Intelligence Reports service).<\/p>\n
![\"1.](\"\/wp-content\/uploads\/2020\/10\/db65c5e2a78dc046e46a006af473516a.JPG\")
Report for the last 30 days on the vector of attacks related to malware distribution (Russia) \u2014 Check Point<\/p>\n
This indicates that the content in email messages is quite vulnerable to exploitation by criminals. When considering the most popular malicious file formats in attachments (EXE, RTF, DOC), it should be noted that they typically contain automatic code execution elements (scripts, macros).<\/p>\n
![\"1.](\"\/wp-content\/uploads\/2020\/10\/a6d1d2d8f374250104e156381b002ea1.JPG\")
Annual report on file formats in received malicious messages \u2014 Check Point<\/p>\n
How to combat this vector of attacks? Email security involves using security tools: <\/p>\n
Antivirus<\/strong> \u2014 signature-based threat detection.<\/p>\n<\/li>\n Emulation<\/strong> \u2014 sandboxing, allowing attachments to be opened in an isolated environment.<\/p>\n<\/li>\n Content Awareness <\/strong>\u2014 extraction of active elements from documents. The user receives a cleaned document (usually in PDF format).<\/p>\n<\/li>\n AntiSpam<\/strong> \u2014 checking the recipient\/sender domain for reputation.<\/p>\n<\/li>\n<\/ul>\n And, theoretically, that\u2019s enough, but there\u2019s another equally valuable resource for the company \u2014 corporate and personal data of employees. In recent years, the popularity of the following type of internet fraud has been growing:<\/p>\n Phishing<\/u><\/strong> (English phishing, from fishing \u2014 catching fish, drawing out) is a form of online fraud. Its goal is to acquire users' identification data. This includes theft of passwords, credit card numbers, bank account details, and other confidential information.<\/p>\n Malefactors are improving their phishing attack methods, redirecting DNS requests from popular sites, and launching entire campaigns using social engineering to send emails. <\/p>\n Thus, to protect your corporate email from phishing, it is recommended to apply two approaches, and their combined use yields the best results:<\/p>\n Technical Protection Tools<\/strong>. As mentioned earlier, various technologies are used to verify and only forward legitimate emails.<\/p>\n<\/li>\n Theoretical Staff Training<\/strong>. This involves comprehensive testing of staff to identify potential victims. Subsequently, retraining is conducted, and statistics are continually recorded. <\/p>\n<\/li>\n<\/ol>\n Today we will discuss the second approach to preventing phishing attacks, namely automated training of personnel aimed at increasing the overall security level of corporate and personal data. Why can this be so dangerous?<\/p>\n Social Engineering <\/u><\/strong>\u2014 psychological manipulation of people to perform specific actions or disclose confidential information (related to cybersecurity).<\/p>\n Let\u2019s refer to an engaging flowchart that briefly outlines the process of conducting a phishing campaign. It includes various stages:<\/p>\n Collection of Primary Data.<\/p>\n In the 21st century, it is hard to find a person who is not registered on any social network or various thematic forums. Naturally, many of us leave detailed information about ourselves: current workplace, group for colleagues, phone, email, etc. Add to this personalized information about a person's interests and you will have data to create a phishing template. Even if it is hard to find people with such information, there is always the company's website, from which you can gather all the information of interest (domain email, contacts, connections).<\/p>\n<\/li>\n Campaign Launch.<\/p>\n Once the \"groundwork\" is prepared, you can launch your own targeted phishing campaign using free or paid tools. During the mailing process, you will accumulate statistics: delivered emails, opened emails, link clicks, credential inputs, etc.<\/p>\n<\/li>\n<\/ol>\n Phishing can be used by both attackers and company security staff to conduct continuous audits of employee behavior. What does the market for free and commercial solutions for automated employee training look like?<\/p>\n![\"1.](\"\/wp-content\/uploads\/2020\/10\/64ed74d70fe7a573c5e14cc03ebef33a.JPG\")
<\/p>\n\n
Trust but Verify<\/h2>\n
![\"1.](\"\/wp-content\/uploads\/2020\/10\/97f19afc49a5101d20cebabe040073a1.JPG\")
A Typical Phishing Attack Scenario<\/p>\n\n
Products on the market<\/h2>\n
\n