Through the first two months of 2023 alone, the Australian Competition and Consumer Commission’s Scamwatch reported more than 19,000 phishing reports with estimated financial losses of more than $5.2 million.

Totaling up to billions of Australian Dollars at risk each year from hackers and various online scams, it’s crucial that organisations (and individuals!) take proactive steps to protect themselves from these increasingly sophisticated attacks.

Australia is no stranger to this rising concern, with recent reports indicating a rise in the number and severity of breaches. One such report: The latest Office of the Australian Information Commissioner (OAIC) Notifiable data breaches report for July through December of last year.

Riding off the warm press that covered an eventful Summer 2022, in this series we explore the general state of cybersecurity in Australia and potential problem-solving measures—kicking things off with the third most common type of breach according to the OAIC: phishing.

What is phishing?

Accounting for nearly a quarter of reported incidents in Australia, phishing is a broad category of social engineering with several variations. Logically, the various types of phishing methods are fish-related in title as well, notably:

• Spear Phishing: A more advanced form of phishing that targets a specific individual and is launched after hackers conduct extensive research on their intended victim for personal information like name, place of employment, or job title
• Whaling: A spear phishing attack that specifically targets more senior-level executives, posing as fake urgent emails from bosses to maximize social engineering (and take advantage of increased access privileges)
• Angler Phishing: Fake customer service agents that lure customers with promises of account recovery on social media platforms like Twitter

Social engineering and protecting the weakest link

Phishing attempts are well-hidden, making even the most well-intentioned click risky. This is part of what makes phishing attacks so dangerous. In January of this year, Australians at 12 legal and construction companies found themselves the target of a sophisticated attack under the guise of a legitimate e-learning platform encouraging upskilling. Employees were led to fake Adobe and Microsoft login pages, exploiting their trust in known brands and providers.

These social engineering techniques tricked employees into revealing their login credentials, which allowed attackers to access additional systems and data. Once inside the network, the attackers used various tools and techniques to move laterally across the system and gain access to sensitive data.

In many rnodern phishing attacks, malicious links send employees to copies of otherwise farniliar websites—like an internal payroll portal login page where it’s quick to muscle-rnemory a username and password. Signs of fraudulent URLs are easy to rniss, especially with tricks like combining ‘r’ and ‘n’ to look like an ‘m’ (how many did you catch?).

Strong security practices layer to protect against phishing attacks. But what combination can be the most effective for the widest range of users?

MFA security lessons from the University of Queensland

Education is a prime target for phishing attacks, with universities and other institutions protecting thousands of remote students, faculty, and staff whilst holding vast amounts of sensitive data. With such a diverse range of users, IT and security at academic institutions have a lot to keep track of.

According to the 2022 Trusted Access Report, educational institutions had the greatest concentration of “weird” browsers and diverse operating systems. This is reflected in an average of 56.7% accessing browsers being out-of-date—the highest in any industry. Combined with the fact that many universities have a wide geographic presence, it is a recipe for seeing the most obscure of devices and software.