Are Critical Infrastructure Workers More Resilient to Phishing Attacks?

Critical Infrastructure Workers Show Higher Engagement in Phishing Simulation Training, New Research Finds

Introduction

New research conducted by Hoxhunt has revealed that phishing simulation training is more effective at critical infrastructure organizations compared to other sectors. The study found that 66% of critical infrastructure employees correctly reported at least one real malicious email attack within a year of training, indicating their heightened awareness and engagement in organizational security. This behavior was also found to be 20% higher than the industry average in terms of threat-detection. While these findings may seem counterintuitive, there are specific reasons behind the increased alertness and reporting behavior of critical infrastructure employees.

Factors Driving Employee Engagement

According to Mika Aalto, co-founder and CEO of Hoxhunt, the critical nature of the work and the strict regulatory policies governing critical infrastructure organizations play a significant role in driving employee engagement in security training. These organizations place great emphasis on maintaining compliance and are more likely to invest in training programs as a strategic security measure. The energy sector, in particular, is a prime target for social engineering and phishing attacks due to the potential for massive economic disruptions. Additionally, compliance requirements create incentives for critical infrastructure organizations to train employees, while other sectors might not have the same regulatory pressure.

The Value of Behavior-Focused Employee Training

The research by Hoxhunt analyzed over 15 million phishing simulations and real email attacks reported in 2022. The high rate of security gaffes and data breaches caused by human behavior highlights the importance of behavior-focused employee training programs. Timothy Morris, chief security advisor at Tanium, emphasizes that despite significant investments in security tools, a single employee’s action can circumvent all defenses. The Colonial Pipeline attack in May 2021 demonstrated the catastrophic consequences of a single password obtained through a data leak. While it is unclear if phishing was involved in the leak, the incident underscored the vulnerability of critical infrastructure sectors.

Resiliency of Critical Infrastructure Workers

The good news is that critical infrastructure workers exhibit a high resilience rate in spotting phishing attacks during simulations compared to the global industry average. The sector’s resiliency rate stands at 10.9%, which is 51% higher than the global average of 7.2%. This data point is particularly significant and highlights the effectiveness of the training provided to critical infrastructure employees. Furthermore, the research found that employees in the sector quickly develop the skills to spot phishing attacks through engaging training programs. After a year of training, they were 65% less likely to participate in a simulated attack.

Common Phishing Attack Tactics

The research by Hoxhunt also identified common phishing attack tactics that affect employees across all sectors, but particularly within critical infrastructure. One prevalent tactic is the use of spoofed internal organizational communications to deceive victims. Critical infrastructure organizations were found to have an 11.4% higher chance of being compromised by this type of attack compared to the global average. Additionally, employees in the communications, marketing, and business development departments showed the highest tendency to fall for phishing campaigns, aligning with global averages.

Conclusion and Recommendations

The findings of this research highlight the importance of phishing simulation training for employees, particularly within critical infrastructure organizations. The higher engagement and threat-detection behavior exhibited by critical infrastructure workers demonstrate the effectiveness of such programs. To mitigate cybersecurity risks, organizations across all sectors should consider implementing behavior-focused employee training programs that actively engage employees in identifying and reporting malicious campaigns or threats.

To further enhance cybersecurity, it is crucial for organizations to invest in robust security measures, including multi-factor authentication, regular software updates, and employee awareness campaigns. By implementing these measures, organizations can bolster their defense against phishing attacks and reduce the risk of data breaches. Moreover, ongoing evaluation of training programs and continuous improvement based on real-world attacks can ensure that employees stay updated and vigilant against evolving cyber threats.

In conclusion, the research findings emphasize the vital role that employee engagement and training play in safeguarding critical infrastructure sectors and organizations as a whole. By prioritizing cybersecurity and fostering a culture of vigilance, organizations can minimize the impact of phishing attacks and better protect their IT and Internet of Things (IoT) environments.