{"id":6781,"date":"2019-04-08T02:33:37","date_gmt":"2019-04-08T06:33:37","guid":{"rendered":"https:\/\/tsisupport.com\/?p=6781"},"modified":"2021-08-09T05:50:10","modified_gmt":"2021-08-09T09:50:10","slug":"dont-sue-your-employees-train-them","status":"publish","type":"post","link":"https:\/\/tsisupport.com\/tsistaging\/?p=6781","title":{"rendered":"Cyber Security Defense: Give Your Employees Vishing and Phishing Training"},"content":{"rendered":"

As someone who handles a lot of IT and cyber security-related fixtures for small businesses every day, I spent a lot of my time on the phone talking to clients about all of the latest attacks. It happened again just the other day – one of my long-term clients called me up and wanted to discuss a story he’d read that was giving him concern.<\/p>\n

The first was the case of Patricia Rielly<\/a>, who was working for the UK Peebles Media Group. Not only did Mrs. Reilly ignore a number of very clear warnings about con artists tricking employees, but she fell into a trap she should have seen coming a mile away. She clicked on a check box on a webform that indicated she knew the risk she was about to take. She handed over about $250,000 of her employer’s money to an online attacker and now, she’s being sued for damages.<\/p>\n

Lawyers indicated that not only did Mrs. Reilly act negligently by falling for such a scam, but she was never authorized to make payments on behalf of her company<\/a> in the first place. She was considered “the office gossip” and was privy to next to no sensitive information. And yet, $250,000 in damages later, she’s now involved in a bitter lawsuit that is making business owners all over the world nervous.<\/p>\n

Setting aside the fact that the owner of the company was more or less oblivious to her ability to access bank accounts to begin with (which is really something that should have been addressed earlier by all parties), it’s easy to see why this is such a big deal.<\/p>\n

My client wanted to know more about why this happened and what he needed to do to make sure it didn’t happen to him<\/em>. Today, I’d like to tell you exactly what I told him:<\/p>\n

“It’s complicated.”<\/p>\n

In this article, I’ll be discussing the need for employee training, the sophisticated threat landscape we all collectively face, and what steps you can take to make sure you don’t have a Patricia Rielly working for your business.<\/p>\n

How on Earth Does This Happen?<\/strong><\/span><\/p>\n

The major reason why situations like those outlined above occur can largely be boiled down to a single word: inaction.<\/p>\n

When a company doesn’t train its employees on all of the latest cyber threats and sophisticated types of attacks, how can you expect them to know how to avoid one? They’re not mind readers. They’re human beings like the rest of us, and human beings are known for making mistakes.<\/p>\n

If the owner of Patricia Rielly’s company had documented policies in place that were reviewed on a regular basis, and had invested in awareness training to bring people up to speed on all the latest threats, there is a very excellent chance that none of this would have happened.<\/p>\n

If you don’t properly vet your employees, how can you be certain that you’re not exposing yourself to one of the 75% of insider cyber attacks that involves malicious intent? That’s easy – you can’t be.<\/p>\n

If you don’t have any types of proactive systems like log monitors and auditors to track anomalous behaviors, how do you spot when someone is engaged in digital activity that is outside their role or the purview of their position?<\/p>\n

You don’t.<\/p>\n

Ultimately, cases like those referenced above are symptomatic of a poor management structure that allowed these types of catastrophes to happen in the first place. Yes, cyber security is complicated and digital criminals are getting savvier all the time. But in the end, it really isn’t much more complicated than that.<\/p>\n

How Phishing is Evolving<\/strong><\/span><\/p>\n

One of the reasons why employee training is so critical has to do with how quickly these types of attacks are evolving. Even if you limited the discussion purely to phishing scams, you’re still dealing with a cyber monster that sprouts three new heads for every one that you manage to cut off:<\/p>\n