65% of social engineering attacks compromised employee credentials

Social engineering is having a notable impact on organizations across a range of industrial sectors in the US.

In fact, 60 percent of surveyed security leaders say their organizations were or may have been victim of at least one targeted social engineering attack in the past year, and 65 percent of those who were attacked say that employees’ credentials were compromised as a result of the attacks, according to Agari. In addition, financial accounts were breached in 17 percent of attacks.

Social engineering attacks, which rely on human interaction and fraudulent behavior to trick people, are the fastest growing security threat for enterprises today. While traditional attacks leverage technology-based system vulnerabilities, such as software bugs and misconfigurations, social engineering attacks take advantage of human vulnerabilities by using deception to trick targeted victims into performing harmful actions.

Examples of social engineering attacks, which are typically launched via email, include phishing, spear phishing and Business Email Compromise (BEC). According to the FBI, BEC scams have resulted in losses of $3.1 billion as of May 2016.

“Until companies stop treating information security as a check box, social engineering attacks are going to thrive. Every employee should practice secure online behavior, and realize the importance of keeping their personal workspace secure. If upper management doesn’t treat information security as a vital part of an employee’s job role, they can’t expect the employee to willingly take on more work to be secure,” social engineer Jayson E. Street, InfoSec Ranger at Pwnie Express, told Help Net Security.

More than 200 respondents participated in the study, from the healthcare, government, financial services and education sectors.

Thirty-two percent of these organizations employ 10,000 or more employees, and 42 percent have more than $1 billion in annual revenue. Highlights from the report include:

Attack volumes and types: 89 percent of respondents have seen either a steady pace or an increase in spear phishing and other targeted email attacks in the past year. Of these attacks, more than 69 percent are after user credentials to commit fraud against the organizations.

Trust and defenses: 49 percent of respondents rate the effectiveness of the current controls they deploy to defend against social engineering attacks as average or below, with 20 percent admitting they didn’t know if their brands have been used in social engineering attacks on customers or partners.

Partner vulnerability: More than one fifth of respondents have ‘no confidence’ in their business partners’ abilities to defend against social engineering attacks that could compromise the respondents’ organizations. 50 percent said they do not have a program in place to audit and encourage partners to authenticate email sent to their organizations, while 21% said they didn’t know if they had this type of program.