Mid-market CEOs: avoiding phishing scams

As you know, phishing is a form of fraud where criminals get in touch – usually via email – pretending to be from a reputable business, colleague, or friend. Their aim is to trick you into providing sensitive information like bank account numbers or a password, or to tempt you to inadvertently download malware like ransomware.?

Phishing is incredibly common. Some experts estimate that more than 90% of cyber attacks start with a phishing email, leading perhaps to billions of lost dollars – not to mention the reputational hit to a business.

Incidents are underreported, and there is effectively no official protection or law-enforcement. Unfortunately, technical solutions are only partially effective.?

So the message for cyber criminals – many of them state-sponsored – is clear: send out enough phishing emails and someone will bite. They’re doing great business and operating with near impunity.?

But we take the CEO’s perspective, which is how to protect your business and its data. From that point of view, the question is: ‘Why do people keep falling for it?’

Here are the most common reasons and what to do about them.?

• Your staff aren’t trained.??

People don’t fall for phishing scams because they’re thick. They fall for scams because they are busy or distracted and nobody ever told them what to look out for – there are no guidelines for releasing information, or verifying identity, or even whom to go to with questions or problems.??

A good CISO, however, will teach staff how to know when somebody is trying to electronically pick their pocket. A CISO will lay on training, lift awareness of the threat, and create security protocols. They will also create an atmosphere of honesty, where staff who make a blunder will report it immediately rather than try to cover it up. ?

• Too many people have access to sensitive information.?

Often in a mid-market business, staff will wear many hats. Whilst this makes for an interesting job, perhaps it’s time to remove a hat or two. Who has access to your bank accounts and credit cards? Is it entirely necessary they do? Everyone in your business should follow the principle of least privilege, where they only have access to the information required to do their jobs.??

So in the event of a breach, the criminals will be confined, rather than have free rein.?

• Your business lacks a culture of security.?

The above precautions will be meaningless unless staff understand that security is a never-ending process. The best CIOs, CTOs, and CISOs will update staff on new threats as they develop and see that training is not one-and-done but periodic. They’ll establish an understanding of the potential risks and ensure the level of spend and planning are appropriate.??

They’ll see that the business gets accreditation like Cyber Essentials+ and that everyone, right up to the CEO, feels invested in the security of the company.??

And they’ll ensure that, in the event of a disaster, there are effective plans, an effective response, and the impact is managed and minimized.?

Unfortunately, there is every indication that phishing attempts will only become more sophisticated and numerous. The good news is that Freeman Clarke CIOs, CTOs, and CISOs have deep experience in helping mid-market businesses stay secure and grow.?

If you’ve got questions about cyber security – or anything else IT related – remember, we’re always up for a no-strings, no-pressure chat.??

Most cyber attacks and data breaches happen to mid-market businesses. Find out the risk to your business with a free, no-strings expert discussion.