Phishing is one of the main ways hackers gain access to your network and your data. CISA, the FBI, and other government agencies released a joint guide on phishing prevention this October in an attempt to inform SMBs and other stakeholders about evolving phishing techniques. To stay ahead of phishing in 2023, it’s important to understand who hackers are targeting and what methods they use to exploit them.
Social Engineering is Still the Weapon of Choice for Hackers
The joint CISA report defines phishing as “a form of social engineering where malicious actors lure victims (typically via email) to visit a malicious site or deceive them into providing login credentials.” While social engineering has long been the preferred attack method for hackers, the popular tools and strategies of social engineering are constantly changing. Current trends in social engineering tactics include:
- Increasing use of social media sites to impersonate and gather info on victims
- Impersonation of large, trusted corporations like Microsoft and PayPal
- Impersonation via compromised email accounts
- More difficult to detect AI-generated phishing
- Spike in obfuscation techniques like HTML smuggling
Healthcare and Financial Institutions are Prime Targets
Two of the hardest-hit industries are healthcare and finance. Healthcare institutions are attractive targets for hackers because they deal with a tremendous amount of sensitive information and valuable data. The industry has seen a 279% increase in Business Email Compromise (BEC) attacks this year alone. According to a report from Vade Secure, phishing attacks rose by 173% and malware threats rose by 110% in the third quarter of 2023—with the financial sector seeing the largest number of phishing URLs. Like medical organizations, financial firms deal with valuable data and provide essential services, making them an ideal target for financially and politically-motivated cybercrime.
Awareness Isn’t Enough
According to the joint CISA report, recommended prevention steps include:
- User phishing awareness training
- Enable MFA
- Implement strong password policies to authenticate users
- Implement DNS filtering or firewall denylists to block known malicious sites
- Implement anti-virus solutions
- Implement file restriction policies that prevent malicious high risk file extensions from being downloaded and executed
- Ensure that software applications are set to automatically update
- Enable safe web browsing policies
- Implement a secure virtual private network (VPN) with MFA enabled
- Consider migrating to managed cloud-based email services from reputable third-party vendors
Get Help Fighting Phishing in 2023
Not sure where to start? Digital Agent can help you improve your cybersecurity and act as your trusted technology consultant. Contact your agent to get started.
Kate Lewis
Technical Writer & Content Strategist
Digital Agent
Follow Us:
