New research has found that staff in ‘technical’ departments are just as susceptible to phishing attacks as other employees.

The study from cybersecurity group F-Secure sent one of four phishing emails to 82,402 individuals across four organisations. Results were based on whether the recipient clicked the links in the email.

Anyone who followed the link was taken to a webpage and given a questionnaire to fill out.

Among the study’s results were that IT professionals proved just as susceptible to the fake phishing attacks as other employees. In one of the four organisations, 26% of the staff in its DevOps department clicked the potentially malicious links, while 24% clicked in its IT department. This was against a 25% click rate across the whole organisation.

Meanwhile, another organisation had a 30% click rate for its DevOps teams, 21% in IT, and an 11% overall rate.

The most effective phishing email was a mock internal HR email threatening annual leave. These saw 22% of recipients click the link, while only 14% reported it.

Emails imitating the organisation’s CEO also proved effective, but less so compared to mock HR. In addition, while emails featuring document sharing requests and service issue notifications both elicited some clicks, they were less effective than the other two.

These three saw higher report rates than click rates. Fraudulent CEO emails especially had the highest report rate.

IT and DevOps reported the email as suspicious at a similar rate to other departments.

In one organisation, IT and DevOps came third and sixth out of nine departments in terms of reporting. In the other organisation, DevOps was the twelfth best at reporting out of sixteen departments, with IT at fifteenth.

When asked if they had noticed a phishing email in their inbox in the past, those that clicked across organisations’ IT and DevOps self-reported at a higher rate than other departments. This suggested either they receive more phishing attacks, or consider themselves better at spotting them.

“Two broad conclusions can be drawn from these results,” wrote Senior Service Delivery Manager at F-Secure Matthew Connor. “Firstly, with their additional accesses, the consistent (or indeed advanced) susceptibility of technical staff and lack of enhanced reporting represents heightened risk.

“Second, a heightened general IT literacy, and likely phishing awareness, does not reduce susceptibility to email phishing.

“If those people employed in ‘technical’ roles are no better at preventing or defending against phishing attacks, why believe we can upskill ‘non-technical’ members of staff to be able to? Instead, we should develop robust security practices to enable those who are less susceptible can protect those who are more at risk.”

Recommended

• Data Privacy Day | 10 major data breaches from 2021
• Cryptocurrency laundering hit £6.4bn high in 2021
• Edinburgh to create CCTV control centre to ‘revolutionise’ security

In addition, F-Secure found that having robust reporting procedures in place was vital to spotting and catching phishing emails.

One of the four organisations provided all departments with access to a button in their email client to report suspicious emails. This group saw staff report 47% of the emails as suspect.

Meanwhile, another organisation relied of forwarding emails to a shared inbox. This saw 13% of staff report the test emails as suspicious.

A third group had rolled out a reporting button to two departments, while the rest forwarded emails on. Departments that used the reporting button had a 44% catch rate, while those without only reported 11%.

The final of the four organisations did not provide reporting data

“Once an email is in an inbox, it is up to the owner of the inbox to deem it suspicious and alert the security teams,” Connor warned. “Failing to provide a single, simple method for reporting means you are likely to have only a quarter of the phishing emails reported than you would otherwise see with a button available.”

The F-Secure study also found that in the first five minutes of an email being delivered, more than three times the number of people who report the email as suspicious will have fallen victim to it.

After five minutes this number begins to even out and after 30 minutes you should expect more reports than clicks.

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

We will keep you up to date on the pivotal issues impacting the sector and let you know about key upcoming events to ensure that you don’t miss out on what’s going on across the Scottish tech community.

To subscribe, click here.