Smishing and other mobile threats should be a priority for CISOs during this time.
Phil Richards, Chief Security Officer at Ivanti, spoke about the dramatic increase in smishing attacks. Anyone who uses a smartphone has probably been the target of a smishing attack at least once. Smishing is like phishing, except that criminals don’t send emails, but text messages. These messages contain malicious links.
See also: Mobile malware: One of the biggest threats to organizations in 2020
Similar to phishing, in phishing attacks, scammers try to trick victims into giving up valuable information, such as banking credentials and more. Typically, the messages are convincing and appear to come from trusted sources. Over the past two years, security experts have noticed a significant increase in these attacks.
See also: Phishing attacks: What are they and how do hackers usually attack?
Even before the COVID-19, 81% of organizations said their employees had experienced an attack on their mobile devices. In 2020, when lockdowns began to be imposed around the world, attacks increased rapidly. One study found that between March and July 2020, smishing attacks increased by 29%.
Why are people more vulnerable to smishing during this period?
Phishing attacks will always be at the forefront, but there are a few reasons why smishing is considered more dangerous for IT security at this time:
- It's much easier to block phishing emails on corporate computers, but remote workers today use their personal devices to access corporate applications and data. And there's no easy way to verify the authenticity of a URL on a smartphone. The result? Many users simply click on the link they see in the message and hope it's nothing dangerous.
- Smartphones are used for almost everything. These devices are literally everywhere, so hackers have turned to attacks that allow them to target smartphone users. Smishing attacks are one of them.
- People are more likely to open and respond to a text messagethan an email. It has been found that 90% of text messages are opened and read almost immediately. The corresponding rate for emails is only 20%.
- Personal devices typically lack the robust security used to protect corporate devices.
- Most people use their smartphones constantly, almost mechanically, so they often don't pay enough attention. Cybercriminals know this well, and they can easily trick an employee into revealing corporate credentials. Once inside a company, hackers can do anything.
As remote work becomes more prevalent, CISOs must implement new strategies to protect corporate applications and data, wherever they are, on any network, device, or cloud. The good news is that most CISOs have recognized the importance of protecting their organizations from mobile threats and have made it a priority.
See also: Bug bounties: Increase in hackers reporting bugs for web, IoT, mobile
A survey by Ivanti found that 87% of CISOs said mobile security is now a focus of their cybersecurity strategies. Nearly 80% of these CISOs know that passwords are no longer an effective or secure means of user authentication, and nearly two-thirds (64%) believe that investing in mobile threat detection software will be a significant priority in 2021.
Source: Threatpost
