2-BPM006737_ Security Awareness report.pdf

Security Awareness

Assessment Summary

CyberSoft Technologies Inc - PrimeroEdge

Period: March 01 2024 - March 31 2024

Introduction

According to the 2022 Verizon DBIR (Data Breach Investigations Report), 74% of all breaches involved the human element with people being involved either via Error, Privilege Misuse, Use of stolen credentials or Social Engineering. Additionally, the 2022 DBIR Report found that BEC and pretexting attacks represent more than 50% of social engineering attempts. By 2025, the business industry will spend almost $200b (InfoSecurity Magazine) on IT Security to protect its assets, customers, and employees through the deployment of security technology, yet will still incur an anticipated $10.5 trillion in corresponding damages (CyberCrime Magazine)

In this report we are assessing the likelihood of CyberSoft Technologies Inc - PrimeroEdge and its users to diffuse, or successfully identify/delete/ignore these hazardous phishing emails through a series of phishing training emails. We are also including statistics of CyberSoft Technologies Inc - PrimeroEdge users to successfully complete any assigned security awareness videos/activities that are included as part of the Security Awareness plan. In successful completion of this Security Awareness Curriculum, CyberSoft Technologies Inc - PrimeroEdge can help to protect the following assets:

1. Customer data

2. CyberSoft Technologies Inc - PrimeroEdge Intellectual Property

3. Employee sensitive data

Phishing and Social Engineering Testing Methodology

Over the course of March 01 2024 thru March 31 2024, CyberSoft conducted the phishing training email campaign for CyberSoft Technologies Inc - PrimeroEdge.

The training campaigns sent simulated phishing emails to selected employees in an effort to understand how the employees behaved, and interacted (or did not interact) with emails that may have been malicious in intent. In all simulated phishing emails, there are opportunities for CyberSoft Technologies

Inc - PrimeroEdge to identify that the subject training email is not authentic, and may be hazardous.

Those characteristics are:

1 Domain & Subdomain

Sender Name is manipulated to represent a trusted name, but the domain name is generic and potentially suspicious. The lesson here is that employees need to ensure that the domain name matches the organization that they believe they are dealing with. An example of this is below:

"By Placing the Trusted Name in the

'Subdomain', Cyber Criminals can trick users into navigating to the Malicious 'Domain'"

2 Email Links & Buttons

The URL or any 'Action Button' in the email does not take a user to where they expect to go. Just as in the instance above, the url has been manipulated, but in this case, the url is routing through an email sending service, and does not navigate directly to the trusted brand url.

Users should HOVER over a url to ensure that a web address is in fact the same as the url that is advertised to them.

Phishing and Social Engineering Testing Methodology

3 Destination Landing Page

The destination landing page, if clicked on by the employee, will send them to a training landing page that will look like an authentic login page of the spoofed email, however, the url (web address) will clearly be different from the web address that the user would have expected to have navigated to.

The lesson here is to always validate that the

URL of the webpage is in fact where you expect to be (i.e., don't just pay attention to the logos and visuals).

4 Training Pop Up

The final assessment and lesson is in the ability to NOT engage with a potentially malicious website. If the employee has not picked up on the first 3 opportunities to notice they are being phished, and they attempt to click within the

'Email/Phone number' or 'Password' fields, or click on any of the 'Sign In' or 'Need help' buttons, those would trigger the pop up of a training document that would highlight to the user that they have been phished.

In this case, the pop up indicates that this is a training exercise and that their data is safe.

Security Awareness Assessment Summary Statistics

Below, you will find a comprehensive historical overview and analysis of phishing campaigns launched during the period of March 01 2024 thru March 31 2024.

Total Campaigns

Total Templates Used

Total Users Included

Total Emails Sent

Total Phish Clicks

Total Potential Shared Data

Campaigns: March 2024 Campaign

Templates Used: Google - New Organization Invite, Zendesk (Invitation)

2 3

2% 0.57x

49 50

2% 9.54x

CyberSoft Technologies Inc - PrimeroEdge

Phishing Campaign Results Per Template

Below you will find a detailed report about the phishing simulation templates used on the campaigns registered during the period of March 01 2024 thru March 31 2024.

Google - New Organization Invite

Campaign: March 2024 Campaign

Google - New Organization Invite Template is designed to let users know that they have been added to a new Google organization. The “Sign In” button will send them to the fake google landing page and will prompt them to enter their email address. Users should notice that: Sender name is not from ‘Google’, hovering over 'Sign In' button does not point to ‘Google’ and landing page is not the Google URL.

In this email, for CyberSoft Technologies Inc - PrimeroEdge the statistics were as follows:

People Who Clicked Total Clicks

Desired Click Rate Variance

Zendesk (Invitation)

Campaign: March 2024 Campaign

Zendesk (Invitation) Template is designed to inform users they have been invited to a Zendesk account and can create an account. This is done by Clicking the

“Create Account” button that will direct users to the Zendesk landing page that will prompt the user for an email address and password. Users should recognize that: sender name is not from ‘Zendesk’, links and ‘Create Account’ button do not point to ‘Zendesk’ and landing page is not the Zendesk URL.

In this email, for CyberSoft Technologies Inc - PrimeroEdge the statistics were as follows:

People Who Clicked Total Clicks

Desired Click Rate Variance

263Emails Sent

1.14%Click Rate

262Emails Sent

19.08%Click Rate

Cyber Threat Results Overview

This overview provides a clear snapshot of the Cyber Threat results found during the period of March

01 2024 thru March 31 2024.

0 Total Results

0 Pending

0 Urgent

0 Reviewed

Summary and Recommendations

Summary

We hope you find this data of your Security Awareness Program Valuable. We recommend you encourage those users to complete the training. We also recommend that as an organization you inform users about how to report when a phishing email is suspected and/or the user has realized he or she may have provided sensitive information.

Recommendations

It is recommended that CyberSoft Technologies Inc - PrimeroEdge engages in regular phishing simulations and employee security awareness training curriculum. The simulations and curriculum are designed to increase frequency and thus awareness and education, while only accounting for 5-8 minutes per month of time from any employee. This is likely the most efficient way to reduce human risk while maintaining productivity and culture.