" phishing Archives - LuxSci

Posts Tagged ‘phishing’

AI Threats to Email Security

Tuesday, October 17th, 2023

Artificial intelligence is a buzzy topic in the tech industry right now. Many experts are looking to AI to help solve some of the complex challenges of our times. However, besides this technology’s helpful and practical applications, there are some concerns that AI can be used for malicious purposes. In this article, we review some of the top threats to email security posed by AI and what you can do to prevent them.

person using ai tool

AI Threats to Email Security

In general, the biggest threat artificial intelligence poses to email is the ability to easily scale and increase the effectiveness of existing threats. The power of AI can be used to craft more effective phishing and business email compromise attacks and potentially cost businesses billions of dollars. Let’s review how artificial intelligence can increase the success of these types of cyberattacks.

AI and Phishing Attacks

In today’s world, phishing emails are often easy to identify. They are typically launched by criminals outside of the United States and use poor grammar, contain misspellings, or are poorly formatted in other ways. As a result, they are straightforward for the average email user to avoid. Artificial intelligence can help correct some of these common errors and make it easier for cybercriminals to create more convincing emails. As a result, we could see more phishing attacks succeed, wreaking havoc on our online security.

Let’s look at an example. Say a hacker from Russia wants to launch a ransomware attack on an American hospital. To do so, they need an email recipient to click on a link in the email that will install malware on their computer, enabling the hacker to gain access to restricted systems. The hacker does not speak English but has been able to launch attacks on other systems using an email drafted to resemble a password reset. Previously, he may have taken this email, ran it through an online translator, and then hit send on the email, unaware of any typos or strange translations that made it into the text. With AI, he can craft a much stronger email that will fool a busy hospital administrator into clicking on the link.

Some AI text generators have taken steps to prevent people from entering prompts that directly ask for prewritten phishing emails. However, artificial intelligence makes it incredibly easy to translate text from other languages in a grammatically correct manner. Scammers can create unique messages at scale that are more likely to fool email recipients.

AI and Business Email Compromise

Business email compromise attacks are one of the most effective email security threats. Still, because of the time and research they take to deploy, they don’t garner as much attention as phishing and ransomware. Artificial intelligence can help speed up essential research about a target to craft business email compromise attacks.

Let’s take another example. Say an individual wants to steal from a major corporation. The attacker decides to impersonate a company vendor and fool them into routing payments to the attacker instead of the legitimate contact. Artificial intelligence can reduce the time it takes to identify potential targets and possible attack vectors. Cybercriminals can use AI prompts to identify profitable companies, locate lists of vendors, and even research individuals in the roles that are likely to interact with the target.

AI can also use prompts like “generate an email asking for payment on a business invoice” to create legitimate seeming business emails. Using these technologies lowers the barriers to executing a successful business email compromise attack, meaning that more cybercriminals will likely attempt them more frequently.

How to Prevent AI Email Attacks

The good news is that the introduction of AI technology has not changed how we fend off these attacks. The first place to start is with policy and training. Business email compromise thefts are easily thwarted by having policies and procedures in place to prevent unusual cash transfers to unauthorized individuals. Ensuring your staff knows the types of threats and raising awareness of the risks can help protect your business.

Secondly, you can implement email filtering technology to help protect your inboxes from emails sent from suspicious sources. Although scammers can craft persuasive messages, they can’t hide their origin. Organizations can use email filtering software to quarantine or stop suspicious messages from reaching employee inboxes. This technology can prevent email domains without SPF or DKIM records from passing through your inboxes, alleviating a common spam tactic.

Conclusion

The threats to email security posed by artificial intelligence are quite serious. Nevertheless, organizations can take steps to protect themselves by implementing the proper defenses. Contact LuxSci today to learn more about our advanced email filtering solutions.

Tags: ai, artificial intelligence, bec, business email compromise, cybercrime, cybersecurity, email filtering, email security, phishing
Posted in LuxSci Library: Security and Privacy
Comments Off on AI Threats to Email Security

Creating HIPAA Compliant Secure Web Forms: What You Need to Know

Tuesday, September 12th, 2023

Creating HIPAA Compliant forms starts with creating a secure website. This process is more complex than creating web pages and adding an SSL Certificate. A certificate is a solid first step, but it only goes so far as to protect whatever sensitive data necessitates security in the first place.

Naive attempts at security can ultimately make the data less secure and more likely to be compromised by creating an appetizing target for the unscrupulous.

So, what do you do beyond hiring a developer with significant security expertise? Start with this article. Its purpose is to shed light on many of the most significant factors in creating secure web forms and how to address them. At a minimum, reading this article will help you intelligently discuss website security with the developers you hire.

person filling out a secure web form on a laptop

Read the rest of this post »

Tags: cross site scripting, eavesdropping, man-in-the-middle, pgp, phishing, s/mime, secure form, secureform, ssl, ssl certificate, trust, web security, website security
Posted in AAA Featured Articles, HIPAA Compliant Forms, LuxSci Library: Security and Privacy, LuxSci Library: Web Design and Programming, Popular Posts
No comments »

Pretexting: The Latest Threat to Email Security

Monday, June 12th, 2023

Verizon recently released its 2023 Data Breach Investigations Report- a comprehensive review of breaches and security incidents occurring over the last year. One surprising finding was a sharp rise in pretexting attacks. To properly respond to these threats, security professionals must understand the risks and prepare for exploitation attempts.

email breach frustration

What is a Pretexting Attack?

A pretexting attack is a type of social engineering scam where the attacker tries to convince the victim to give up valuable information or access to a service or system by creating a story or pretext.

These types of scams are a form of phishing. However, pretexting requires more effort than regular phishing attacks that aim to reach as many potential victims as possible and fool one of them into clicking on a malicious link.

To successfully execute a pretexting scam, attackers spend time learning about the target and use the information to manipulate human behavior to achieve a desired outcome. The threat actor may spend more time performing reconnaissance and engaging with the victim. This time investment means that pretexting is often used in attacks with a higher anticipated payout.

In the 2023 Data Breach Investigations Report, analysts found that 50% of all social engineering attacks are pretexting incidents. This represented a 2x increase from the 2022 report. With these types of attacks on the rise, organizations must understand the threat and how to protect themselves from these breaches.

What’s an Example of a Pretexting Attack?

In a business context, pretexting falls under the category of business email compromise scams. Every pretexting scam includes two main elements- a plausible situation and a character. First, by creating the right situation to present to the victim, it is possible to fool the target into believing it is legitimate. Secondly, selecting the right person or organization to impersonate is equally essential.

If the attacker fails to pick a plausible scenario or chooses the wrong entity to impersonate, it drastically reduces the likelihood of success. That’s why these schemes require surveillance and research to achieve their aims.

Some common pretexts or scenarios that you should watch out for include the following:

  • A CEO or manager asking for an urgent transfer of funds to an unusual account
  • A vendor or supplier asking for payment of an unpaid invoice
  • A coworker asking for a password to an account they should already have access to

If the attacker has adequately researched the target, they can be quite convincing in impersonating a legitimate source and convincing them to hand over valuable information or assets.

How to Protect Against Pretexting Attacks

Instilling a healthy dose of skepticism in employees is always recommended. Proper training and reminders can help employees remain suspicious of requests for information and funds they do not expect. In addition, implementing the right policies and technologies can help reduce the risk of falling for a pretexting scam. Some additional steps to take to secure your email accounts include:

  • Deploying SPF, DKIM, and DMARC to prevent spoofing.
  • Using email filtering tools to flag suspicious email activity.
  • Installing anti-malware software on all devices can help mitigate the effects if a malicious link is clicked.
  • Deploying multi-factor authentication to guard against the risk of password theft and stolen credentials.
  • Updating business processes to ensure financial payments are appropriately vetted and signed off on.

Do you need help securing your email accounts? Contact LuxSci today to learn how we can help your business avoid falling victim to pretexting scams.

Tags: bec, business email compromise, cybersecurity, email filtering, mfa, multifactor authentication, phishing, pretexting, social engineering
Posted in LuxSci Library: Security and Privacy
Comments Off on Pretexting: The Latest Threat to Email Security

The Security Risks of Staffing Challenges

Wednesday, March 29th, 2023

The cybersecurity talent shortage is a known issue that the government, industry groups, and educators are working to address. But as CISOs are asked to do more with fewer resources and support, it can risk healthcare organizations’ cybersecurity. The “Implications of Stress on CISOs 2023 Report” by Cynet found that many security teams faced retention challenges due to work-related stress that could put their data at risk.

The Security Risks of Staffing Challenges

When security teams are understaffed, they can become overworked and burnt out. As a result, they have less time to focus on updating security policies, training staff, and monitoring the attack surface. The impacts of staffing challenges can significantly affect the ability of security teams to detect and respond to threats. The survey found that 65 percent of CISOs stated that work-related stress affected their capacity to safeguard their organization. In addition, 77 percent of CISOs believed their insufficient bandwidth and inadequate resources caused critical security initiatives to be neglected. These lapses are not going unnoticed. Seventy-nine percent of CISOs have received complaints from colleagues claiming security tasks are not being adequately handled.

the security risks of staffing challengesWith limited choices, organizations must be wise and strategic in the technology they employ. When asked about the technology initiatives that could positively impact their work-related stress levels, 57 percent of the respondents cited consolidating multiple security technologies on a single platform or interface as a possible solution. Additionally, 51 percent of the respondents believed automating time-consuming and repetitive manual tasks would help reduce their workloads.

Candidate Quality Staffing Challenges

When security teams cannot find qualified candidates to fill open positions, crucial tasks are left incomplete, and other team members must pick up the slack. In turn, this can lead to compounding issues with employee satisfaction and retention. Of the surveyed CISO teams, 74 percent reported losing team members due to work-related stress issues.

According to the report, nearly half of the teams had more than one CISO resign over the last 12 months. The impact of stress levels is seen in retention rates and recruitment efforts, with 83 percent of CISOs admitting they have had to compromise on the quality of new hires to fill vacancies left by departing employees.

Solving retention and recruitment issues is essential to improve your organization’s security posture. Rethinking the hiring process and investing in entry-level talent is just one approach to filling the cybersecurity talent pipeline.

Ways to Alleviate the Security Risks of Staffing Challenges

While solving staffing challenges will take time and investment from the public and private sectors, there are ways to streamline and automate tasks to reduce the burden on security teams.

According to Deloitte, email is a significant vector of security risk for many healthcare organizations. 91% of all cyber attacks begin with a phishing email. Healthcare organizations have more to worry about than cyberattacks. They are also vulnerable to insider threats and have serious data compliance obligations. Employees must understand data loss prevention and how to protect sensitive information that is shared externally.

By using LuxSci’s best-in-class secure email technology, it can drastically reduce the burden on security teams. Protect from external threats by employing advanced email filtering to stop cybercriminals from even reaching inboxes. In addition, LuxSci’s email encryption is enabled automatically to protect sensitive data in transit. It’s easy to administer and doesn’t require security and IT teams to spend hours developing keyword lists, analyzing gaps, and training employees. By reducing the risk of your email communications, security teams can focus their limited resources on critical security initiatives.

Contact LuxSci today to learn how our experienced team can help alleviate the burden on your security and IT teams.

Tags: ciso, cybersecurity, cybersecurity risk, email encryption, email filtering, email security, operational efficiency, phishing, risk assessment, secure connector, secure email, security risk, staffing
Posted in LuxSci Library: Security and Privacy
Comments Off on The Security Risks of Staffing Challenges

The Cybersecurity Risks of Mergers and Acquisitions

Thursday, February 2nd, 2023

In tough economic times, many businesses go through mergers and acquisitions to improve their financial prospects. However, this process can put organizations’ sensitive data at risk. In this article, we discuss the cybersecurity risks of mergers and acquisitions. According to a report by Forescout, 62 percent of participants agreed that their company faces significant cybersecurity risks by acquiring new companies and expressed that cyber risk is their biggest concern post-acquisition.

cybersecurity risks of mergers and acquisitions

Before M&A: Assess Cybersecurity Risk

Even before mergers and acquisitions are announced, it can be a vulnerable time for a company’s data. Leakage of sensitive company data, like confidential financial information, can be catastrophic to negotiations. As a result, this makes companies considering a merger or acquisition highly susceptible to hacking.

Internal threats are also likely to increase. Employees not involved in negotiations may learn about merger talks and have some incentive to leak data to the press or to criminals to stop the process. It is essential to protect all communications relating to merger discussions.

The most significant risk of a merger is not doing cyber due diligence on the company being acquired. Risk analysis needs to be a part of negotiation talks. Most organizations being merged or acquired are smaller, with low levels of sophistication, and may lack mature cybersecurity programs. You need to understand the potential risks your company may be inheriting to prepare to address them properly. Security personnel need to be included in M&A talks to ask the right questions, audit systems, and prepare for integration.

Addressing Risk During Integration

Once a company merges with another, the risks to sensitive data increase. Highly sophisticated threat actors target M&A activities because, with operations in transition, high-value data is often vulnerable. 

The Technology Risks of Mergers and Acquisitions

In 2019, the IBM Institute for Business Value surveyed 720 executives responsible for the merger and acquisition functions at acquirer organizations. More than one in three said they experienced data breaches that can be attributed to M&A activity during integration.

IT changes may be extensive and cannot all take place at once. It’s essential to take time to fully understand inherited policies, equipment, and procedures before making rapid changes. Enterprise IT projects take time to plan and complete without disrupting day-to-day operations.

IT teams will deal with a new mix of assets, technologies, processes, and organizational culture during integration. Risks continue to evolve during the initial period of change as they learn more about inherited systems and processes. They may also be overwhelmed by integration tasks integral to day-to-day operations, so that security tasks may be a lower priority. It’s incredibly important to prioritize security and have a well-organized transition to ensure that sensitive data is not exposed.

The Personnel Risks of Mergers and Acquisitions

Changing personnel can also create gaps in your security program. Employees with institutional knowledge may leave the company, meaning crucial processes and procedures must be re-documented and updated. If teams are understaffed in essential areas, they may take shortcuts that leave sensitive data exposed.

Staff burnout and uncertainty from the transition can also lead employees to make mistakes. Phishing and business email compromise threats are prevalent in the early days of a merger or acquisition. People may report to new managers and fall prey to social engineering-style attacks because of their unfamiliarity with new reporting lines and company hierarchy.

It’s important to prioritize security training and update all employees on policies after a merger occurs. Clearing up ambiguity helps to reduce risk and builds trust in the organization.

How to Reduce Cybersecurity Risk During a Merger or Acquisition

Utilizing basic email security features like filtering and message encryption can go a long way to protect sensitive data and limit risks. Whenever confidential information is shared, it should occur through secure or encrypted channels. Leaked information can lead to negative consequences and volatility.

The best way to reduce risk is to plan for it. It’s critical to thoroughly understand the risks you will inherit by merging with or acquiring another company. This should include thoroughly reviewing risk assessments and IT systems and even bringing in a third-party to assess their cybersecurity. The time to find out about these liabilities is before the merger occurs, not on day one. 

Tags: business email compromise, cybercrime, cybersecurity risk, email encryption, email filtering, email security, hacking, phishing, risk reduction
Posted in Business Solutions, LuxSci Library: Security and Privacy
Comments Off on The Cybersecurity Risks of Mergers and Acquisitions

« Older Entries