Last week, the SANS Institute reported a data breach. The irony of the situation is that SANS is a cyber security training institution that offers information security training and security certification to users worldwide.
SANS released a
statement on their website: “We have identified a single phishing e-mail as the vector of the attack. As a result of the e-mail, a single employee’s email account was impacted. Aside from the affected user, we currently believe that no other accounts or systems at SANS were compromised.” A phishing email managed to fool an employee into downloading malicious code onto their computer. The code caused 513 emails to be sent to an external email address with approximately 28,000 records of personal information (PII) for SANS members. The good news is that SANS is sharing information on the attack and how it was carried out with the cyber security community in the hopes of preventing a similar attack. Bleeping Computer has posted details of how the malicious code was downloaded and how it all works
here.
The bad news here is that if a cyber security organization like SANS could be breached, anyone can be breached. It all comes down to human error. Cyber awareness training is something that must be practiced on an on-going basis. Business owners and employees need to be suspicious of any email that comes in with an attachment. Questions you need to ask yourself: is this email really from the person they claim to be? Do I really need to open this attachment of click on the link?
If you or your staff have trouble answering these types of questions, then perhaps it is time to consider some cyber awareness training for your organization. Uzado offers a cyber awareness training program that will help train you and your staff to understand what phishing emails look like, and how to avoid downloading malware and ransomware. Contact us today.
