Nearly half of IT decision-makers surveyed say employees have 'fallen for the phish'

SecureData, a member of the JSE-listed ERP.com Group and a southern African distributor for Websense, today announced the results of its Phishing Trends study, which is part of the company's annual Web@Work survey conducted by Harris Interactive.

From 21 to 28 February 2005, 354 US IT decision-makers who work for organisations with at least 100 employees were interviewed online and from 28 February to 21 March 2005, 500 US employees who have Internet access at work and who work for organisations with at least 100 employees were surveyed over the telephone on phishing and IT security in the workplace.

According to Websense's 2005 Phishing Trends Survey, only one-third (33%) of employees polled said they have heard of phishing. Similarly, 4% of employees surveyed admitted they had 'fallen for a phish' and clicked through a link to a phishing Web site at work.

Conversely, 82% of IT decision-makers surveyed stated their employees have received phishing attacks via e-mail or instant messaging (IM). In addition, 45% of IT decision-makers surveyed who have had employees receive a phishing attack said their employees did click through the URL on the phishing attack. This discrepancy might suggest employees have a difficult time deciphering whether a Web site accessed via a link in an e-mail or instant message is legitimate or 'spoofed' - a fraudulent Web site that appears to be authentic. Not surprisingly, half (50%) of the IT decision-makers surveyed do not believe employees can accurately identify phishing sites.

"Phishers are becoming more sophisticated in their deception techniques to lure employees to spoofed Web sites, as most employees cannot determine which is a valid site and which is a fake," commented Dan Hubbard, senior director of security and technology research, and head of Websense Security Labs, at Websense, Inc.

"However, employees don't have to 'fall for the phish' and actually enter confidential information on a phishing Web site to be compromised. By simply clicking on a phishing URL, the site can install spyware, such as a malicious keylogger, on the employee's computer which has the ability to capture data such as network passwords or social security numbers without their knowledge."

Phishing is a relatively new phenomenon, but it is already viewed as an important security problem for IT decision-makers - 32% of IT decision-makers polled report that phishing attacks have caused security problems for their organisations in the past year. In addition, the majority of IT decision-makers surveyed do not feel their company is well protected from Internet security threats, such as phishing attacks. Forty-three percent feel their company is only somewhat protected, and 14% feel their company is not very, or not at all, protected.

"Although the Websense survey shows that only 4% of employees admit to clicking on phishing URLs, this is actually a high number in the security community," added Brian Burke, research manager for security products at IDC. "It only takes one employee to click on a phishing site and accidentally give out confidential corporate data, customer records, network passwords, or trade secrets, to jeopardise an entire organisation's intellectual property."

To mitigate Web-based threats such as phishing attacks, 60% of IT decision-makers surveyed reported they block executable programs (attachments) transmitted through e-mail. However, only 14% said they block HTML within e-mails. Also, 47% of IT decision-makers surveyed said they block executables transmitted through IM, but only 24% indicated they block HTML within IM.

"Most organisations already prevent attachments coming in through e-mail; however, HTML within e-mails is frequently left unblocked-leaving employees vulnerable to attack from phishers hungry for confidential personal and company data," continued Hubbard.

Websense Security Labs mines more than 50 million Web sites per day, searching for sites infected with malicious code, such as spyware and phishing sites. More than 13 000 infected sites were discovered in the first quarter of 2005 alone. Websense Security Labs researches today's advanced Internet threats and delivers timely product and information updates to the security community and Websense customers to support them in making their infrastructure more secure.

2005 phishing trends survey results:

* Phishing attacks: One-third (33%) of employees surveyed said they have heard of phishing, but only 4% said they had ever 'fallen for a phish' and clicked through a link to a phishing Web site at work. However, half (50%) of IT decision-makers surveyed believe employees cannot accurately identify phishing sites. This may be the case, as 82% of IT decision-makers polled report their companies have had employees receive a phishing attack via e-mail or IM, and 45% of these decision-makers polled said that employees did click through the URL.

* Protection against phishing: The majority of IT decision-makers surveyed do not feel their company is well protected from Internet security threats, such as phishing attacks. Forty-three percent feel their company is only somewhat protected, and 14% feel their company is not very, or not at all, protected.

* Security concerns: 32% of IT decision-makers surveyed believe that phishing attacks have caused security problems for their organisations in the past year. Spyware (65%), followed by employee use of bandwidth-clogging applications, such as streaming media (42%), and employee use of unlicensed/unsanctioned software (39%), were also listed as security concerns.

* What companies block: When asked if they block executables and/or HTML, 60% of IT decision-makers surveyed said they block executable programs transmitted through e-mail, but only 14% said they block HTML within e-mails. Likewise, 47% said they block executables transmitted through IM, but only 24% indicated they block HTML within IM. 47% of IT decision-makers surveyed report that their companies block executables transmitted through the Internet.

* Phishing education: The most popular sources of education for IT decision-makers to learn about new Web-based threats, such as the latest phishing attack, are online media (44%) and security vendors (35%).

* Internet security training: 58% of IT decision-makers surveyed have either an Internet security awareness programme, or an Internet security training programme, or both. Larger companies tend to do more in terms of Internet security - of those IT decision-makers surveyed, fully half (50%) of those who work for mid-sized companies (defined as companies with 100-500 employees) said they do not have any sort of security awareness or training programme versus 36% of those who work for large companies (501-1 000 employees) and 29% of those who work for very large companies (1 001 or more employees).

Web@Work is a comprehensive annual survey of Internet and application usage in the workplace. By surveying both employees and IT decision-makers, the study reveals unique insights on employees' surfing habits as well as IT decision-makers' perspective on the top network problems facing today's organisations. Web@Work is commissioned by Websense, Inc and conducted by Harris Interactive. This is the sixth annual Web@Work survey.

Data for these surveys were collected by Harris Interactive on behalf of Websense. Harris Interactive is solely responsible for the online and telephone data collected and Websense is responsible for the data analysis. Both parties collaborated on the survey questionnaire.

The employee survey was conducted by telephone within the US between 28 February and 21 March 2005 among a nationwide cross-sample of 500 adults aged 18+ who have Internet access at work and work at a company with at least 100 employees. The IT decision-makers survey was conducted online within the US between 21 and 28 February 2005, among a nationwide cross section of 354 IT decision-makers in companies with more than 100 employees. Data are not weighted and are representative of those employees and IT decision-makers surveyed.

In theory, with probability samples of this size, one can say with 95% certainty that the overall employee results have a sampling error of plus or minus four percentage points and the overall IT decision-maker results have a sampling error of plus or minus five percentage points. Sampling error for the various sub-sample results: Employees who had received and fallen for phishing scams (19); IT decision-makers who have had employees receive a phishing attack (291); and IT decision-makers who work for a mid-size (100-500 employees) company (125), a large (501-1 000 employees) company (56) and a very large (1 001+ employees) company (173) is higher and varies. This online sample is not a probability sample.

Harris Interactive Inc (www.harrisinteractive.com), the 15th largest and fastest-growing market research firm in the world, is a Rochester, New York-based global research company that blends premier strategic consulting with innovative and efficient methods of investigation, analysis and application. Known for The Harris Poll and for pioneering Internet-based research methods, Harris Interactive conducts proprietary and public research to help its clients achieve clear, material and enduring results.

Harris Interactive combines its intellectual capital, databases and technology to advance market leadership through US offices and wholly owned subsidiaries: London-based HI Europe (www.hieurope.com), Paris-based Novatris (www.novatris.com), Tokyo-based Harris Interactive Japan, through newly acquired WirthlinWorldwide, a Reston, Virginia-based research and consultancy firm ranked 25th largest in the world, and through an independent global network of affiliate market research companies.

For further information, please contact Willem Barnard at telephone (011) 257 8600; fax (011) 257 8699; e-mail willemb@securedata.co.za.