Social manipulation
To reduce the risk, it is not enough to focus only on training. Organizations should combine human, organizational and technical measures.
An important measure is good email filters that stop phishing before it reaches the user. In addition, phishing-resistant authentication (Passkeys / FIDO2) is currently the most robust solution against phishing.
Phishing-resistant authentication replaces passwords and is tied to both the user and the service. This means that even if an employee clicks on a fake link, the login will not work – because the key only works with the real service.
Support for phishing-resistant authentication is already available from leading providers such as Microsoft, Google and Apple, making implementation easier.
By combining technical measures with good routines and training, you significantly reduce the attack surface.
To protect the organization, you should:
To measure the level of information security, simulated phishing attacks can be carried out, where realistic emails are sent to employees. Clicks, logins and responses are analyzed to uncover vulnerabilities.
A phishing exercise provides valuable insight into how resilient the organization is – and what you should continue working on to strengthen the security culture.
Kristiansand Municipality experienced the nightmare when two stolen user accounts led to 5 million spam emails being sent across all of Norway. Read about their costly experience and why they chose to conduct a phishing exercise for all employees afterward.