AgdaPkt 2020-12-21 Amended Joint SA PFA

Browse Search

6.D. - Page 17 of 33 Cybersecurity training is a well-established industry — providing a focused set of classes and materials designed to reduce users' clicks on harmful links and attachments. Security training, awareness, and assessment should be a routine part of the Cybersecurity strategy in government. Deploying such a program covers the education, training and testing of employees to recognize, delete and report attempted attacks. Studies show these programs reduce but do not eliminate user error. Government Technology magazine captured it best in their cover story entitled "In the quest to guard against cyberthreats, can we solve the people problem? The Weakest Link.1138 The article concluded that even with the best training programs and defenses, the human element may never be completely overcome.39 This is precisely why recurring training and user testing is encouraged by best practices. Handling Incoming Emails — Phishing Defenses In a worldwide survey of Managed IT Service Providers (MSP's) in 2019, "67% of Ransomware attacks originated from a phishing or spam email ... the easiest method of delivery and man does it pay off.1140 The greatest threats take advantage of users "within" the network, i.e., users who click on malicious links or open email attachments that contain viruses or make other mistakes that allow hackers to gain access to the entity's system or network. Trend Micro estimates that the vast majority of all attacks occur when a user clicks on something they should not 41 There are different ways to help the user community recognize and protect against a phishing attack. Most network environments utilize spam filters to automatically filter incoming messages. Spam filters are used to detect unsolicited, unwanted, and virus -infested email and stop it from getting into email inboxes.42 "Additionally, malware detection software can also be highly successful in reducing the risk of Ransomware but the anti-malware definitions (a database of known infectious code) need to be constantly updated... which takes effort and time but represents the single most effective defensive strategy.1143 Message rules can be used to flag external emails and thereby decrease the probability that a user clicks on bad content. An administrator can set up message rules on a users' client or the email server. An example of a message rule might be if the sending organization includes @smithco.com in the sender's address, the message is automatically moved the incoming message into a personal folder called "Smith Company." A better example would be a rule that flags all external emails (not from the host's domain) and warns about the threats of clicking on attachments or weblinks. An example of this visual potential threat message rule is displayed in Appendix C. 38 Government Technology Magazine, Adam Stone, The Weakest Link, Oct/Nov 2018 39 Ibid 40 VadeSecure — Predictive Email Defense, Ransomware Attacks: Why Email is still the #1 Delivery Method", January 16, 2020 41 https://blo,>�ndmicro.comlonIine-phishi_n,-how-to-stay-out-of-the-hackers-nets/ 42 https://%v�vw.niailcliannels.com/what-is-sponi-filtering! 43 Epicor, Protecting Yourselffrom Ransomware ", January 2020 2019-2020 San Mateo County Civil Grand Jury 9 138