What the GoDaddy Multi-Year Attack Should Teach Us About Phishing Awareness Training

By Jared Hrabak, Consulting Cybersecurity Engineer, cStor and MicroAge

Whether you’re relatively new to your cybersecurity role or a veteran, this post is for you. One of the most crucial components of your security strategy should be user awareness training, specifically phishing awareness. Attackers are becoming more elaborate in their schemes, as evidenced by the discovery of a multi-year plan to inject malware on GoDaddy servers that began with a data breach in 2021 and have recently been found to be sending sophisticated phishing emails right from infected company domains. It doesn’t matter if you host elsewhere; what matters is whether or not you’re in a strong defensive posture to effectively deal with social engineering attacks.

Enter Phishing User Awareness Training.

Phishing user awareness training is a type of education program designed to help your employees at every level recognize and avoid phishing attacks. These attacks are a common type of cybercrime in which criminals send fake emails that appear to be from legitimate sources in order to trick people into giving away sensitive information such as passwords or financial details. The training typically involves educating individuals about the common tactics used by phishers, how to spot suspicious messages, and what to do if they receive a phishing attempt. You can see why gaining direct access to a company’s domain via malware could be so effective.

Features to Include in Your Phishing Awareness Training Program

As you research getting a program in place or upgrading your existing program, here are a few important features that you should be sure are included:

• Determine what type of rewards-based program is right for the organization. Although this point is often overlooked, this can dramatically impact the effectiveness of your security program.
• Examples of real-life phishing attacks and how to spot the signs of a phishing attempt.
• Information on the common tactics used by phishers, such as creating fake websites or using urgent language to trick people into responding quickly.
• Tips on how to protect yourself from phishing attacks, such as being cautious when clicking on links in emails or text messages and using strong passwords.
• Guidance on what to do if you think you have received a phishing attempt, such as reporting it to the appropriate authorities and changing your passwords.
• Regular updates and reminders to keep employees aware of the latest phishing threats and how to protect against them.
• Interactive and engaging content that makes the training fun and interesting for employees.
• Realistic simulations of phishing attacks that give employees practice spotting and responding to these threats.
• Flexible delivery options, such as live online courses or on-demand (self-paced) training to accommodate different learning styles and preferences.
• Regular updates to keep the training relevant and up-to-date with the latest phishing threats and tactics.
• Measurable results and reporting features that allow you to track the effectiveness of the training and identify areas for improvement.

Overall, phishing awareness training aims to help individuals become more vigilant and better equipped to defend against these types of cyber attacks.

Key Phishing Awareness Metrics

As with any component included in your cybersecurity strategy, I highly recommend you implement some target metrics to aim for, so here are a few on my priority list that your program — whether home-grown or from an expert partner — should include:

• Report rates: the number of people that report phishing attempts and the reaction times.
• Report time: how long it takes for employees to report a phishing attempt.
• Completion rates: The percentage of employees who have completed the phishing awareness training program.
• Engagement rates: The percentage of employees who actively participated in the training and demonstrated an understanding of the material.
• Knowledge retention: The ability of employees to recall and apply the information from the training over time.
• Number of phishing attempts: The number of phishing attempts that are reported and successfully mitigated.
• Damage prevention: The extent to which the training has helped prevent losses or damages caused by phishing attacks.

These metrics can provide valuable insights into the effectiveness of your phishing awareness training program and help you identify areas for improvement. It’s important to track these metrics regularly and use them to continuously improve your training efforts.

If you need some expert guidance on building a phishing awareness training program specific to your organization’s user base and needs, please don’t hesitate to reach out… we’re here to help.