Cybercrooks are on the prowl, designing one trick or the other to fleece unsuspecting victims. Telecoms infrastructure have become a willing tool in the arsenal of the virtual marauders. They often send text messages to unsuspecting account holders in banks alleging the suspension of their accounts for one reason or the other, LUCAS AJANAKU reports.
An alarming 91 per cent of hacking attempts begin with some kind of phishing attack, which uses email and social engineering to gain access to confidential data.
Mimecast, an international firm that specialises in cloud-based email management for Microsoft Exchange and Microsoft Office 365, including security, archiving, and continuity services to protect businesses, said hackers attempt to dupe recipients by luring them to open an attachment, click on a link, divulge confidential information or even wire money to a fraudulent account.
The Director-General, National Information Technology Development Agency (NITDA), Dr. Isa Ali Ibrahim Pantami, said cyber security is about enlightenment, because no matter how well the system is secured, if there is no education, the possibility of being attacked remains high.
He said: “Most of our people are good at opening any message that comes to them. Any email, they open, particularly those that promise to give money online. They would just see an attachment from Mali, or Morocco or South Africa or from Zimbabwe saying: ‘my husband died last year and left behind $60 million and I am looking for somebody that is trustworthy; I want to give such person the money, and I am as well about to die with cancer. My doctor said in the next few weeks, I would die, so I want to give you $50 million; $25 million is for you, $25million is for charitable activities.”
“So, people are eager to open. So that is why we need to create awareness; so cyber security is all about creating awareness. If your people are well enlightened, 70 per cent of the problem is solved already. No matter how well our system is secured, as long as our people still open unsolicited emails, opening and downloading any email without knowing the sender; and as long as our people are still using pirated copies of software on their operating system, and many more, it is difficult for them to be secured. That is why creating awareness is very important.”
Head of Cyber Security Solutions, Internet Solutions, Kenya, Dr. Bright Gameli Mawudor, agrees with Pantami.
He said what makes the attacks effective is social engineering which effectively makes hacking the human brain quite easy.
Mawudor spoke about Social engineering – how it works and how it is get used at the Mimecast: Anatomy of an Email-Bourne Attack presentation at the second Annual AfriSecure Cyber Security Summit in Johannesburg, South Africa.
“As human beings, we are very open especially on social media, and all this information is incredibly valuable to hackers. We are the problem. People are the problem,” he said.
Mimecast said essentially, it is human nature that makes people so vulnerable – we desire to be helpful, have the tendency to trust people we don’t know, and have a fear of getting into trouble, which are all traits that social engineers are able to capitalise on.
Social engineers are able to create confidence that they are who they say they are and that they are legitimately seeking information.
Even people who don’t consider themselves to be trusting by nature are vulnerable when presented with the right story, the right voice, the right speech pattern, the right body language, and so forth.
The reason phishing attacks are often successful is because it usually appears to come from a known or trusted source, often impersonating a C-level executive.
As such, phishing email attacks can be remarkably difficult to identify, and even when employees are trained on how to spot a possible phishing attack or CEO Fraud, 23 per cent of phishing emails are still open.
With the potential for phishing scams to cause disruption to business operations, damage to reputation and loss of business costing millions of dollars, organisations urgently need a sophisticated solution for preventing a phishing attack.
Mimecast MD Brandon Bekker however warned: “It’s not just about potential monetary loss, as this can often be recovered – it is reputational damage that is very difficult to recover from. The world is changing and email has become a successful place for cybercriminals to operate as it is far easier to hack a person than a system.”
Mimecast Targeted Threat Protection (solution) provides a highly-effective solution for preventing a phishing attack, defending against malicious links in email, weaponised attachments and social engineering attacks to protect users and organisations from the dangers of advanced threats.
Mimecast improves phishing email and spear security by scanning all inbound emails in real-time, providing three levels of protection:
URL Protect scans all URLs within incoming and archived emails, identifying websites that are potential risks before opening a clicked link in the user’s browser.
Attachment Protect opens attachments in a virtual environment or sandbox that is isolated from the corporate email system, and enables employees to access it only once it passes security checks.
Impersonation Protect scans incoming email to identify potential malware-less attacks that use social-engineering to spoof employees into making fraudulent wire transfers.
“We believe it is very important to have a layered approach to email security, as this is how even physical security systems work.
“Your business most likely has multi-layered security, with guards or access control, electric fencing, alarms, CCTV, and more. When it comes to security, a multi-layered approach simply makes sense,” Bekker said.
With Mimecast Targeted Threat Protection, organisations can prevent a phishing attack, spear phishing attack or whale phishing threat without the need for additional infrastructure or IT overhead.
