FEATURE
impersonates a commonly used application to coax users into reentering login credentials or other personal information . Brand hijacking is when a hacker uses a spoofed domain to impersonate a reputable company .
Such attacks are hard to detect because users have become accustomed to receiving legitimate emails from applications prompting them to reenter their credentials . Requests from Microsoft 365 , Amazon and Apple asking users to confirm their identities , reset their passwords , or agree to new service terms are commonplace in many user inboxes , so most don ’ t think twice before clicking links that ultimately send them to phishing sites .
Our research shows that in 2021 , Microsoft was the most impersonated brand , used in 57 % of phishing attacks . One in five organisations using Microsoft 365 had an account compromised in 2021 .
The growing acceptance by users of regular and repeated alerts and prompts is also being actively exploited by attackers . One example , MFA spamming or ‘ fatigue ’ relies on bombarding users relentlessly with authentication messages until they click on one just to make it stop – and in doing so hand access to their compromised account to the attacker .
How to protect your organisation
Security leaders need to ask themselves two questions . First , do our users know how to distinguish between a legitimate email and an email threat ? Second , are our security systems equipped to distinguish between a legitimate email and an email threat and to respond immediately to block or contain and mitigate any damage if it ’ s the second ?
Employee security awareness
Regular employee awareness training across all the potential email threats they might encounter at work is critical in protecting an organisation against email-based attacks . Employees should understand how different email threats
Toni El Inati – RVP Sales , META & CEE , Barracuda Networks function , how to identify them and where and how to report them .
Next-generation security for nextgeneration threats
Advanced email threats are difficult to detect with traditional email security gateways alone . They require a security approach that involves multiple layers of protection . No system is 100 % secure against every email threat , especially when it is encountered for the first time .
It ’ s therefore important that security leaders implement advanced threat
38 www . intelligentciso . com