If you're an employee who repeatedly clicks on links in phishing emails, you should be fired. That's the view of Frank Lombardo, chief technology officer of Melbourne-based Insignia Financial, who was a panelist at The Australian Financial Review's Cybersecurity Conference yesterday to discuss the critical cyber threats facing businesses.
See also: Who is the new AMBERSQUID cryptojacking campaign targeting?
Australians suffered a record $3.1 billion in losses to fraud last year, up from $2 billion in 2021, according to the ACCC, while some of Australia's largest companies suffered devastating data breaches in the past year.
Speaking about the devastating impact on businesses if hackers gain access to IT systems, Lombardo said that Insignia, a financial services company, regularly tests its employees by sending them simulated phishing emails, to see who clicks on them.
"This is part of awareness and education and training," he said.
The spokesperson explained that clicking on suspicious links can be grounds for termination, but clarified that the termination process “does not happen overnight” and will be a result of the employee’s “multiple failures” to detect phishing or malware.
"Ultimately, you have to recognize that if you've done everything you can and if there's a weakness ... then you have to take the appropriate action, because the consequences are serious if you get it wrong," Lombardo said.
For some employees, he said, this may mean “performance management,” or rather the more severe measure of “removing people who simply can’t do it.”.
"You have to take this really, really seriously at all levels of your organization," he said.
"If you don't, then [your company] will fail.".
See also: Pig butchering crypto scam: Hackers stole $1 million in three months
The devastating consequences of cyberattacks for businesses and customers have been evident over the past 12 months, with major breaches at Optus, Medibank and Latitude.
Companies can suffer significant financial and reputational damage in the event of a breach, and dissatisfied customers are increasingly filing class-action lawsuits to punish businesses that operate with inadequate security protections and protocols.
See also: Bumblebee malware: New attacks abuse WebDAV folders
Hackers who gain access to sensitive corporate information often try to force those companies to pay a ransom that runs into the millions.
Information source: 9news.com.au
