What are the main cybersecurity challenges for the CISO? What are the priorities and how can the CISO address them? Cybersecurity expert Rob Musquetier compiled his top 3 biggest priorities for the CISO and provides practical tips on how CISOs can address them. This second part explains the CISO's second-biggest challenge: the impressive quality of fake emails, which in some cases is even too good to be recognized.

‍

Quality of fake emails too good to be recognized

‘Don't click on links, watch out for spelling errors, and check the email address’ – these are the well-known tips for recognizing fake emails and a standard part of the average awareness training. However, the quality of fraudulent emails and phishing campaigns is unfortunately too high to be recognized using only standard tips. Cybercriminals know so much about you and your organization that a fake email is almost indistinguishable from a real one. What can a CISO do to increase the chances of recognizing fake emails and limit the damage?

‍

What can a CISO do to increase the chances of recognizing fake emails?

To increase the chances of recognizing fraudulent emails, the CISO can:

• Proactively inform employees about the latest developments;
• Refine awareness training for better recognition;
• Refine and actively promote the reporting procedure for fake emails;
• Conduct fake email campaigns themselves;
• Evaluate fake email campaigns and formulate specific improvement actions.

‍

What can a CISO do to prevent or limit damage from fake emails?

To prevent or limit damage from fake emails, a CISO can conduct phishing campaigns themselves. This gives the CISO a clear insight into how many people within their own organization click on 'malicious' links. By providing feedback after the campaign on the results and the specific characteristics employees should have noticed to identify a fake email, employees' knowledge levels will increase, and the number of employees prone to clicking will decrease.

By having a better understanding of what can go wrong, employees will also be more likely to report if they suspect they have clicked on a wrong link, allowing the CISO to take quick action.

Key takeaways on fake emails and phishing campaigns

Some (larger) organizations develop and maintain their own awareness programs. Due to the rapid pace of change, it is more convenient and less labor-intensive for organizations to opt for cybersecurity training from an expert, ensuring the awareness training is always up-to-date. Another additional benefit is that participation is registered and evaluated, allowing the CISO to see where people struggle, but also to easily demonstrate that the organization's awareness training complies with obligations such as GDPR and ISO standards.

Also read the other two parts about the Top 3 CISO challenges in cybersecurity:

Part 1: Cybercrime and ransomware: a rapidly growing problem

Part 3: Limited budget and CISO authority

‍

Questions about cybersecurity? Ask Navaio! Navaio - Contact