sb-au logo
Story image

Proofpoint: Social engineering and credential stuffing attacks up in 2018

30 Jan 2019

Cybersecurity and compliance company Proofpoint has released its fifth annual State of the Phish Report which uncovers phishing cyberattack trends across more than 15 industries and details the fundamental cybersecurity knowledge of more than 7,000 working adults in the US, Australia, France, Germany, Italy, Japan, and the UK.

Data from tens of millions of simulated phishing attacks sent over a one-year period were analysed along with nearly 15,000 cybersecurity professional survey responses, from both Proofpoint customers and outside organisations, to provide an in-depth look at the state of global phishing attacks.

Overall, 83% of global infosecurity respondents experienced phishing attacks in 2018, up from 76% in 2017, and nearly 60% saw an increase in employee detection following security awareness training.

In addition, more organisations were affected by all types of social engineering attacks (phishing, spear phishing, sms phishing, voice phishing, and USB drops) year over year.

For the first time, compromised accounts bypassed malware infections as the most commonly identified impact of successful phishing attacks.

“Email is the top cyberattack vector, and today’s cybercriminals are persistently targeting high-value individuals who have privileged access or handle sensitive data within an organisation,” says Proofpoint security awareness training general manager Joe Ferrara.

“As these threats grow in scope and sophistication, it is critical that organisations prioritise security awareness training to educate employees about cybersecurity best practices and establish a people-centric strategy to defend against threat actors’ unwavering focus on compromising end users.”

This year’s State of the Phish Report key findings include the following:

Infosecurity professionals reported a higher frequency of all types of social engineering attacks year over year. 

Phishing increased to 83% vs. 76%. Spear phishing increased to 64% from 53%.

Vishing and/or smishing increased to 49% vs. 45%, and USB attacks increased to 4% vs. 3%.

Credential compromise has increased 70% since 2017 and 280% since 2016, surpassing malware infections to become the most common phishing attack impact in 2018.

Respondents reporting phishing attacks, that resulted in data loss, more than tripled between 2016 and 2018, underscoring the growing phishing threat and impact from such attacks.

83% of global respondents experienced phishing attacks in 2018, demonstrating a 9% year-over-year increase.

Only 10% of respondents reported experiencing a ransomware attack, confirming that ransomware took a back seat to other types of attacks last year. 

59% of suspicious emails reported by end users were classified as potential phishing, indicating that employees are being more diligent and thoughtful about the emails they receive.

Baby boomers outperformed all other age groups in fundamental phishing and ransomware knowledge, underscoring why organisations should not assume a younger workforce has an innate awareness of cybersecurity threats.

Educating employees about today’s cyber threats is essential. 

In a global survey, working adults identified the following terms correctly: phishing (66% correct), ransomware (45% correct), smishing (23% correct), and vishing (18% correct).

These findings spotlight a knowledge gap when it comes to the language security teams are using when communicating to end users.

Link image
Virtual demo: Diagnose network cabling problems with the LinkIQ Cable+Network Tester
If you’re finding it difficult to install access points and cabling, or if you can’t pinpoint an issue with a video camera or end user, the LinkIQ Cable+Network Tester could be exactly what you need. Try a free, fully interactive demo now.More
Story image
Video: 10 Minute IT Jams - Who is Okta?
Okta is an identity and access management company, specialising in secure user authentication. It's an enterprise-grade identity management service, built for the cloud, but compatible with many on-premises applications.More
Story image
Financial malware activity dropped in 2020 as creators honed their wares
Cybercriminals used the time to plan more malicious propagation techniques, both new and evolved from previous methods.More
Story image
FortiGuard appoints former cyber warfare officer
Former RAAF cyber warfare officer Mark Robson has been appointed as senior tactical threat analyst in FortiGuard’s managed detection and response team, FortiResponder.More
Story image
Dell Technologies unveils new data protection innovations for hybrid cloud workloads
The Dell EMC PowerProtect Backup Service, powered by Druva, is designed to deliver SaaS app protection without increasing IT complexity.More
Story image
5G network security a US$9 billion dollar opportunity - report
The cloud-native nature of 5G networks will have a disruptive and positive impact on the cybersecurity industry in the next few years, with 5G network security presenting a US$9 billion enterprise market opportunity by 2025.More