Update your user training: More malware via links than attachments
by Rich SuttonOctober 3rd, 2007
MessageLabs released a study last week on malicious emails. They found that attackers using email to distribute threats are increasing relying on users to click through on links in the email, as opposed to clicking on attachments.
This means a couple of things to me:
(1) Most everybody has deployed AV at the mail gateway.
(2) Your web filter is becoming an ever more important device in securing your network.
(3) Users need more training.
You might be tempted to think that the move to links and away from attachments has come because fewer users are opening attachments from untrusted sources. I’m sure that’s happening to some extent. If that was a lesson in your existing user training, then nice work!
But the threat landscape is constantly changing. Attackers will always be moving to the next weak spot in your systems and your users’ behavior.
In a previous post, I talked about using your web filter’s reporting to identify users that need training.
I should also mention that it’s good practice to ensure that your mail clients don’t have the AutoPreview feature (or pane) enabled. Give your user a chance to apply that training on the mail subject and source, before he tells his mail client to render that HTML email.
December 6th, 2007 at 12:56 pm
[...] It’s also worth noting that this entire attack relies on social engineering. As has often been mentioned in our blog, despite the attention that software vulnerabilities receive, your most vulnerable attack surface remains your users’ collective web savvy. Training is your most effective weapon for this. [...]