To click or not to click: What F-Secure learned from phishing 80,000 people
According to a new study from cybersecurity company F-Secure, phishing emails mimicking HR announcements or asking for assistance with invoicing get the most clicks from recipients.
The study, To Click or Not to Click: What we Learned from Phishing 80,000 People, involved 82,402 participants and tested how employees from four different organisations responded to emails that simulated one of four commonly used phishing tactics.
Of the recipients, 22% that received an email simulating a human resources announcement about vacation time clicked, making emails that mimic those sent by HR the most frequent source of clicks in the study.
An email asking the recipient to help with an invoice (referred to as CEO Fraud in the report) was the second most frequently engaged email type, receiving clicks from 16% of recipients.
While Document Share (notifications from a document hosting service) and Service Issue Notification (messages from an online service) emails received clicks from 7% and 6% of recipients, making them the least frequently clicked emails in the study.
"The study's most notable finding was that people working in 'technical' roles seemed equal to, or even more susceptible to phishing attempts than the general population," says F-Secure Service Delivery manager and lead author of the report, Matthew Connor.
"The privileged access that technical personnel have to an organisation's infrastructure can lead to them being actively targeted by adversaries, so advanced or even average susceptibility to phishing is a concern," he says.
"Post-study surveys found that those personnel were more aware of previous phishing attempts than others, so we know this is a real threat. The fact that they click as often or more often than others, even with their level of awareness, highlights a significant challenge in the fight against phishing."
Out of the two organisations studied with personnel working in IT or DevOps, both clicked test emails at rates that were either equal to or higher than other departments in their organisations: 26% from DevOps and 24% from IT compared to 25% for one organisation, and 30% from DevOps and 21% from IT compared to 11% for the other organisation.
The study also found that these departments were no better at reporting phishing attempts than others. In one organisation, IT and DevOps came third and sixth out of nine departments in terms of reporting. DevOps was the 12th best at reporting out of 17 departments in the other organisation, while IT was 15th.
The value of a fast, easy-to-use reporting process was also highlighted in the report. During the first minute after the test emails arrived in inboxes, over three times the number of people who reported it as suspicious had clicked. This number levelled out at around five minutes and stayed consistent after that.
While reporting became more common as time went on, the different processes at different organisations played a key role. 47% of participants from an organisation that provided all employees with a dedicated button to flag suspicious emails used it during the study. Only 13% and 12% of participants from two other organisations reported their test emails (the remaining organisation did not provide data on reporting).
F-Secure director of Consulting, Riaan Naude, says the patterns in reporting and click rates identified by the study highlights a practical opportunity for organisations to mobilise employees in a collective effort to protect themselves against phishing.
"The evidence in the study points to fast, painless reporting processes as common ground where security personnel and other teams can work together to improve an organisation's resilience against phishing," he says.
"Getting this right means that an attack can be detected and prevented earlier, as security teams may only have a few precious minutes to mitigate a potential compromise."
