sb-nz logo
Story image

Proofpoint: Social engineering and credential stuffing attacks up in 2018

30 Jan 2019

Cybersecurity and compliance company Proofpoint has released its fifth annual State of the Phish Report which uncovers phishing cyberattack trends across more than 15 industries and details the fundamental cybersecurity knowledge of more than 7,000 working adults in the US, Australia, France, Germany, Italy, Japan, and the UK.

Data from tens of millions of simulated phishing attacks sent over a one-year period were analysed along with nearly 15,000 cybersecurity professional survey responses, from both Proofpoint customers and outside organisations, to provide an in-depth look at the state of global phishing attacks.

Overall, 83% of global infosecurity respondents experienced phishing attacks in 2018, up from 76% in 2017, and nearly 60% saw an increase in employee detection following security awareness training.

In addition, more organisations were affected by all types of social engineering attacks (phishing, spear phishing, sms phishing, voice phishing, and USB drops) year over year.

For the first time, compromised accounts bypassed malware infections as the most commonly identified impact of successful phishing attacks.

“Email is the top cyberattack vector, and today’s cybercriminals are persistently targeting high-value individuals who have privileged access or handle sensitive data within an organisation,” says Proofpoint security awareness training general manager Joe Ferrara.

“As these threats grow in scope and sophistication, it is critical that organisations prioritise security awareness training to educate employees about cybersecurity best practices and establish a people-centric strategy to defend against threat actors’ unwavering focus on compromising end users.”

This year’s State of the Phish Report key findings include the following:

Infosecurity professionals reported a higher frequency of all types of social engineering attacks year over year. 

Phishing increased to 83% vs. 76%. Spear phishing increased to 64% from 53%.

Vishing and/or smishing increased to 49% vs. 45%, and USB attacks increased to 4% vs. 3%.

Credential compromise has increased 70% since 2017 and 280% since 2016, surpassing malware infections to become the most common phishing attack impact in 2018.

Respondents reporting phishing attacks, that resulted in data loss, more than tripled between 2016 and 2018, underscoring the growing phishing threat and impact from such attacks.

83% of global respondents experienced phishing attacks in 2018, demonstrating a 9% year-over-year increase.

Only 10% of respondents reported experiencing a ransomware attack, confirming that ransomware took a back seat to other types of attacks last year. 

59% of suspicious emails reported by end users were classified as potential phishing, indicating that employees are being more diligent and thoughtful about the emails they receive.

Baby boomers outperformed all other age groups in fundamental phishing and ransomware knowledge, underscoring why organisations should not assume a younger workforce has an innate awareness of cybersecurity threats.

Educating employees about today’s cyber threats is essential. 

In a global survey, working adults identified the following terms correctly: phishing (66% correct), ransomware (45% correct), smishing (23% correct), and vishing (18% correct).

These findings spotlight a knowledge gap when it comes to the language security teams are using when communicating to end users.

Story image
Video: 10 Minute IT Jams – A glimpse inside a ransomware cell
This is our second IT Jam with SonicWall senior manager of product marketing Brook Chelmo, and in this video Brook walks us through his one-on-one experience with a member of a ransomware cell. More
Link image
The importance of data resilience in the current cybersecurity climate
Protecting an organisation's data is one of the most crucial functions of any CISO. Strategies should be in place where data is stored securely and cost-effectively.More
Story image
BlackBerry, Microsoft enter partnership for Teams integration
"Integrating BlackBerry AtHoc will ensure that any organisation managing critical events using Teams is able to contact, alert, and account for everyone within the organisation directly."More
Story image
Cybersecurity market continues meteoric ascent
With the increase in cyberattacks, organisations are continuing to spend more money on security. However, without a focused cybersecurity strategy, they often spend it in the wrong areas.More
Story image
BlackBerry partners with ServiceNow for incident response management
BlackBerry has announced it has entered into a partnership with ServiceNow to integrate the BlackBerry AtHoc service within the Now platform for rapid crisis communications and IT service management. More
Story image
Research: Younger cybersecurity pros more fearful of being replaced by AI
According to the findings, 53% of respondents under 45 years old either agreed or strongly agreed that AI and ML are a threat to their job security, despite 89% of this demographic believing that it would improve their jobs.More