The release of the Australian Competition and Consumer Commission’s (ACCC) 2023 Targeting scams report may come with a sigh of relief. Despite predictions that Australians would lose more than AUD 3.15 billion to scams in 2023, it appears that the combined losses reported for the year were $2.74 billion, a 13% decrease from 2022, the report indicates.
However, while financial losses reportedly decreased, Australians made more than 601,000 scam reports—18% more than the 507,000 scam attempts reported in 2022.
The report highlighted the top scams by loss, with phishing ranking in the top five with $137.4 million in recorded losses. This shouldn’t be surprising; after all, phishing attacks are one of the least expensive attacks to launch, yet they generate huge payouts.
Why Phishing Thrives Today
Phishing helps bad actors access a network and search for sensitive data in order to conduct a ransomware attack at a later stage. It’s popular, at least in part, because it’s cheap to conduct. An entire phishing campaign, including a phishing kit and hosting, can cost as little as $50. Also, phishing is so effective because every employee is a target. In an organisation with thousands of employees, one oversight by an individual can bring the entire organisation down. Remember, an organisation’s security is only as strong as its weakest link.
How to Combat Phishing Attacks
While there are numerous ways to safeguard your digital enterprise, here are four of the most important:
1. Train employees to recognise phishing attempts. Have a red team in your organisation identify vulnerabilities, play the role of an attacker, and periodically simulate attacks. Awareness training can promote good habits, such as taking a step back and inspecting anything unusual received over email, SMS, or a phone call. If you receive an email from a legitimate source asking you to do something urgently, it is always best to reach out to the sender separately to confirm the message.
2. Deploy phishing-resistant MFA. Unauthorised access can be prevented by using phishing-resistant multi-factor authentication. These apps require a passkey that can only be accessed with, for example, your Face ID or fingerprint authentication.
3. Deploy UEBA and SOAR for proactive detection and response. A properly equipped security information and event management (SIEM) tool with user behaviour profiling will help spot anomalies. User and entity behaviour analytics (UEBA) features variables that are customisable; they can be based on time, event patterns, and number of events triggered. Security orchestration, automation, and response (SOAR) capabilities are machine learning (ML) driven to automatically execute workflow profiles and assign tickets to security admins to quickly remediate a phishing attack.
4. Monitor privileged users. Privileged users are one of the top targets for spear phishing attacks because of their access to sensitive information. Ensure visibility into privileged user account activities, follow the principle of least privilege, and train privileged users to exercise caution.
Today, phishing thrives on social engineering, so it’s vital to stay vigilant, especially if you have privileged access to your network. If you find anything out of the ordinary, always trust your gut, take a step back, and analyse the situation.
Australian organisations must prioritise being as cyber-aware as possible amid the changing cyberthreat landscape. It’s the only way to ensure you don’t become the weakest link.
