Conduct Phishing Training in the Aftermath of It Outages

The Role of Security Awareness Training After IT Outages

Jul 26

Lev Lesokhin Lev Lesokhin is an experienced business technologist, a former software developer, consultant, and tech executive. Having started his career at MITRE, Lev has had many touch-points with cybersecurity thought leaders over the years. In his current role as OutThink's Executive Vice President for Technology and Analytics, he works with customers and industry leaders to build a quantitative framework for evolving security awareness into human risk management.

View Profile

In this article

Lessons from the CrowdStrike Incident The Cybercriminals’ Phishing Tactic: Exploiting Trust Phishing Training: The Psychology of Being Fooled Security Awareness Training to Build a Strong Line of Defense Why Security Awareness Training Must Encourage Personal Precautions Strengthening Security Awareness and Vigilance

Discover OutThink's AI-Powered Phishing Simulator

View Demo

Lessons from the CrowdStrike Incident

Last week’s global IT outage serves as a poignant reminder of why we must continuously fortify our defenses through engaging employees in security awareness training. In a matter of hours, cybercriminals were working to exploit CrowdStrike’s service interruption to launch phishing attacks by registering hundreds of lookalike domains. We’ll explore how these attacks work and how organizations can equip employees to combat such threats.

The Cybercriminals’ Phishing Tactic: Exploiting Trust

Phishing attacks thrive on trust and urgency. Following CrowdStrike’s service issue, cybercriminals crafted emails that appeared to be legitimate communications from the company, copying style and tone of maximum chance of successfully breaching their targets. However – phishing isn’t new, and the approach is far from innovative.

Why Hot Topics and News Stories Are Prime Phishing Attack Opportunities:

High Engagement and Interest: People are naturally drawn to news stories, especially those that directly impact them.

Sense of Urgency: Emails demanding immediate action, such as “Update your account now,” exploit recipients’ fear of missing out or losing access. This urgency can cloud judgment and lead to risky decisions.

Trust in Familiar Sources: Mentioning trusted companies like CrowdStrike lends credibility to phishing attempts, increasing their effectiveness.

Phishing Training: The Psychology of Being Fooled

Understanding the psychology behind why people fall for phishing scams can help organizations to develop better defenses:

Authority Bias: People tend to comply with requests from authoritative sources. Emails that appear to come from a reputable company or figure can easily deceive recipients.

Fear and Anxiety: Phishing emails often play on fear and anxiety, such as the fear of losing access to an account or the anxiety of missing out on important updates. This emotional manipulation can lead to quick, unthinking responses.

Cognitive Overload: In a busy work environment, employees may not have the time to scrutinize every email. Cybercriminals exploit this by sending emails that look legitimate at a glance, hoping that recipients will act without thorough examination.

Security Awareness Training to Build a Strong Line of Defense

The silver lining in these attack waves is that they often exploit human vulnerabilities, not just technical flaws. This means comprehensive employee training & engaged learners can act as a robust safeguard. Below is a non-exhaustive list of basic areas such training should cover.

Educate on Phishing Recognition

Regular training sessions help employees identify common signs of phishing, such as:

Generic greetings.

Unsolicited attachments.

Urgent, unexpected requests.

Using real-world examples, like the CrowdStrike incident, makes training more relatable and impactful.

Promote Verification Habits

Encourage employees to verify the authenticity of suspicious emails by:

Double-checking the sender’s email address.

Contacting the organization directly through verified channels.

Verifying information is especially important when emails concern service disruptions or other unusual activities.

Realistic Phishing Simulations

Conduct periodic phishing simulations to:

Test employee vigilance.

Provide immediate feedback and additional training where necessary.

Phishing training should be continuously updated based on employee feedback and the most current phishing trends.

Encourage Reporting Suspicious Activities

Foster a no-blame culture where employees feel safe so that they:

Report suspicious activities without fear of reprisal

Are incentivized to engage in early reporting can help IT teams mitigate potential threats before they escalate.

Why Security Awareness Training Must Encourage Personal Precautions

While organizations must implement overarching policies, individuals play a crucial role in maintaining security. Here are essential steps everyone should follow to avoid becoming a victim:

1. Scrutinize Email Content. Always take a moment to scrutinize emails, especially those requesting any form of urgent action or containing attachments. Look for grammatical errors, suspicious URLs, or email addresses that don’t match the sender’s claimed identity.

2. Use Strong, Unique Passwords. A strong password is your first line of defense. Use complex passwords for all accounts and avoid using the same password across multiple platforms. Password managers can help generate and store unique passwords securely.

3. Enable Two-Factor Authentication (2FA). Enabling two-factor authentication adds an additional security layer. Even if your password is compromised, 2FA ensures that your accounts are not easily accessible without a secondary verification method.

4. Keep Software Up-to-Date. Regularly update your software, including antivirus programs, operating systems, and any applications you use. Software updates often include security patches that fix known vulnerabilities.

Strengthening Security Awareness and Vigilance

The phishing scams leveraging CrowdStrike’s recent incident highlight a critical need for robust cybersecurity awareness training and resilience. By prioritizing employee education and steadfast personal practices, we can collectively thwart these phishing attempts. By prioritizing employee education and personal precautions, organizations can build a formidable defense against phishing attacks. A well-trained workforce encouraged to continuously update its knowledge and maintain vigilance is our greatest asset in combating cybercrime.

Enjoyed this blog post? Share it with someone!Share