Network Security News

Employees have high fail rate at detecting phishing scams

Monday, September 14, 2009

Some companies hire outside IT security firms to conduct social engineering tests on their employees' response to phishing emails and other scams. The results are not very encouraging for corporate network security.

One such testing firm, Redspin, said it has conducted hundreds of social engineering assessments for corporations and financial institutions which included telephone based password acquisition, email phishing and thumb drive drops.

For email phishing, Redspin reports a 22 percent failure rate among employees. Phone phishing gets an even higher failure rate of 53 percent. At the organization level, 94 percent of all companies had at least one employee respond to phishing email, while 72 percent of companies had at least one worker get fooled by phone phishing.

One of the social engineering tests performed by Redspin involves giving away free thumb drives, which hackers can use to spread malware and spyware.

Last month, the National Credit Union Administration (NCUA) reported that member credit unions were receiving packages purporting to come from NCUA containing CD-ROMs containing malware.

It turned out the CD-ROMs were sent by a firm called Microserved, which was authorized to test credit unions for their response to such a real attack.