You are about to leave Risk Strategies website and view the content of an external website.
You are leaving risk-strategies.com
By accessing this link, you will be leaving Risk Strategies website and entering a website hosted by another party. Please be advised that you will no longer be subject to, or under the protection of, the privacy and security policies of Risk Strategies website. We encourage you to read and evaluate the privacy and security policies of the site you are entering, which may be different than those of Risk Strategies.
0nly dumb people fall for email phishing attacks, right? 0f course, everyone thinks they’re immune. 0nly a tech neophyte would fail to pick up on a sketchy note – especially from a familiar source.
Well, did you notice the first letter in each sentence of the opening paragraph was not a capital “O”? It was a zero. And you’d really have a hard time noticing the same trick in an embedded URL. This deception is a well-established hacking technique called a homoglyph, or homograph, attack. The URL www.g00gle.com looks odd in text, but not so obvious in an embedded link only visible briefly as you click.
Lots of people fall for business email compromise (BEC) attacks. Worse, it usually takes a while for a business to discover an attack has succeeded. According to IBM’s “Cost of a Data Breach Report 2023” (seriously, the link is fine), the mean time to identify a BEC was 194 days. The mean time to contain the mess was 72 days.
Big or small, any business is at risk. If the threat actor targets a corporation of 1,000 employees, it’s a safe bet that not everyone knows each other. Any one person could mistakenly fall into a BEC scam out of simple ignorance. Today’s remote work trend only adds to this type of exposure. Even in an attack on a small organization of 40 people, familiarity can be exploited. A BEC attack spoofed to look like the boss urgently requesting certain login credentials might not raise an eyebrow. A busy staff wearing lots of hats might not look too closely at the details and rush to meet the request.
So, what’s a business to do? Educate, educate, educate, and then educate some more:
Remember, time is money. Take the time to verify unique or external emails and requests. In today’s world of electronic banking and ransomware, an extra 10 seconds to inspect an email or link could save your organization from an unauthorized transfer, a large ransom payout, or weeks of time rebuilding locked systems.
Want to learn more about protecting your business from cyberattacks and their liability costs? The Cyber team at Risk Strategies can help you gain a better understanding of your cyber risk profile, improve deficiencies, connect with cyber resources, and get comprehensive insurance coverage.
Find Will Burke on LinkedIn here.
Connect with Risk Strategies Cyber Liability team here.
About the author
Will Burke specializes in commercial insurance and contract surety for the construction industry. He advises on risk management best practices, including the importance of phishing awareness training for the whole workforce.