Roger Grimes, a cybersecurity expert, discusses phishing in the podcast. Stories include a phishing service shutdown, an Ohio man shooting incident due to a phone scam, and an email scam from a Chinese company. The podcast highlights real-life vulnerabilities, LinkedIn impersonation challenges, and the importance of cybersecurity awareness and defense strategies.
Social engineering and phishing account for 70-90% of successful data breaches, emphasizing the need for strong defenses in policy, technical, and training aspects.
Organizations often neglect investing in training to combat social engineering attacks, allocating minimal resources despite their prevalence as a primary threat.
Frequent security awareness training and simulated phishing campaigns are essential to educate employees effectively and reduce susceptibility to phishing attacks.
Deep dives
Three types of defenses for every threat: policy, technical, and people
Roger emphasizes the importance of having three types of defenses for every cybersecurity threat: policy, technical, and training for people. He highlights that social engineering and phishing are responsible for 70 to 90% of successful data breaches, and by addressing these issues effectively, organizations can mitigate a large portion of cybersecurity risks.
Underestimation of social engineering and phishing defenses
Roger stresses that organizations often underinvest in training employees to recognize and prevent social engineering attacks. He notes that even with the prevalence of social engineering as a primary attack vector, companies allocate minimal resources, such as only 3% of their security budget, towards combating this crucial cybersecurity threat.
Significance of frequent security awareness training
Roger advocates for frequent security awareness training, highlighting that conducting sessions once a year is insufficient. He recommends regular training and simulated phishing campaigns, ideally on a weekly basis, to educate employees effectively and reduce their susceptibility to phishing attacks.
Role of healthy skepticism in cybersecurity protection
Roger emphasizes the importance of instilling a healthy dose of skepticism in individuals when encountering unexpected and unusual requests. He advises teaching family members, including elderly individuals, to be cautious of social engineering attempts and to verify requests using trusted methods before taking any action.
Impact of AI on cybersecurity and phishing sophistication
Roger discusses how artificial intelligence has enabled cybercriminals to create more sophisticated phishing attacks, increasing the challenges in cybersecurity defense. While AI may heighten cybercrime, he suggests that fundamental cybersecurity practices, such as awareness training and skepticism towards unexpected requests, remain crucial in mitigating social engineering threats.
Roger Grimes, a Data Driven Defense Evangelist from KnowBe4 and author is discussing his new book, "Fighting Phishing: Everything You Can Do to Fight Social Engineering and Phishing." Dave and Joe share some listener follow up, the first being from listener Tim, who shares a story of him almost falling for a scam involving some of his investment assets. Lastly, Dave and Joe share a story from an anonymous listener who wrote in to share about a LinkedIn imposter nightmare. Dave's story focuses on a how the LabHost PhaaS platform was disrupted by a year-long global law enforcement operation, resulting in the arrest of 37 suspects, including the original developer. Joe shares the story of an 81 year old Ohio man, who was arrested after shooting a woman after both of them got wrapped up in a phone call scam. Our catch of the day comes from Robert, who writes in with what he believes is a email scam from a Chinese company called "Infoonity."
Please take a moment to fill out an audience survey! Let us know how we are doing!