{"id":1496,"date":"2018-05-07T15:40:17","date_gmt":"2018-05-07T19:40:17","guid":{"rendered":"https:\/\/solutionsreview.com\/security-information-event-management\/?p=1496"},"modified":"2018-06-08T11:29:39","modified_gmt":"2018-06-08T15:29:39","slug":"protect-enterprise-gdpr-phishing-scams","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/security-information-event-management\/protect-enterprise-gdpr-phishing-scams\/","title":{"rendered":"How to Protect Your Enterprise Against GDPR Phishing Scams"},"content":{"rendered":"

\"GDPR<\/p>\n

In just over three weeks, the compliance deadline for the European Union\u2019s (EU\u2019s) <\/span>General Data Protection Regulation (GDPR)<\/span> will arrive. On May 25th, enterprises that collect and store data on EU citizens\u2014including enterprises not based in the EU\u2014must comply with GDPR mandates or pay a truly heavy fine: 20 million euros OR 4% of annual sales whichever is higher. <\/span><\/p>\n
Widget not in any sidebars
\n

Enterprises, unsurprisingly, have started to panic as the deadline looms. Hackers, ever the malicious opportunists, are starting to take advantage of that panic. Legitimate enterprises are sending out emails seeking consumers\u2019 consent for storing their data and alerting them to data privacy policy changes\u2014both requirements of GDPR compliance. Hackers and digital threat actors are also sending out emails, posing as legitimate enterprises to steal consumer credit card information and identity data. In other words, we\u2019ve entered into the era of GDPR <\/a><\/span>phishing scams<\/span>.<\/span><\/p>\n

GDPR Phishing Scams: A Rising Threat<\/b><\/h3>\n

Cybersecurity and pen testing firm <\/span>Redscan<\/span><\/a>\u00a0has been credited as uncovering the new wave of GDPR phishing scams after investigating attacks posing as emails from hospitality giant Airbnb. These emails contain many of the same components of a normal phishing attack: the facsimile of legitimacy, a sense of urgency, and a mechanism in which victims input their information allowing the hackers to steal them. GDPR phishing scams differ only in the manner the sense of urgency and the facsimile of legitimacy are presented, but they\u2019ve proven incredibly effective. \u00a0\u00a0\u00a0<\/span><\/p>\n

According to a statement by Mark Nicholls, Director of Cyber Security at Redscan, \u201cScammers know that people are expecting exactly these kinds of emails this month and that they are required to take action, whether that’s clicking a link or divulging personal data. It’s a textbook phishing campaign in terms of opportunistic timing and having a believable call to action.\u201d <\/span><\/p>\n

“As we get closer to the GDPR implementation deadline, I think we can expect to see a lot a lot more of these types of phishing scams over the next few weeks, that’s for sure.\u201d <\/span><\/p>\n

At time of writing, it is unclear how many enterprises are being used as masks for GDPR phishing scams, but Redscan\u2019s research indicates that more of them are forthcoming…and more enterprises will be victims of these attacks in the near future. <\/span><\/p>\n

GDPR Phishing Scams Hurt Your Enterprise<\/b><\/h3>\n

Redscan\u2019s research indicates that GDPR phishing scams are targeting consumers, yet your enterprise is not safe from them. The majority of targeted emails are business emails\u2014most likely because these are easier to scrape off the web. Given the prominence of poor password behaviors, an employee losing their personal password to a GDPR phishing scam can still jeopardize your enterprise\u2014and that supposes that your employees didn\u2019t give the phishers their business credentials. <\/span><\/p>\n

Phishing attacks constitute over \u00bc of all enterprise frauds. A single phishing attack can cost an enterprise over a million dollars in damages. One employee is all it takes to compromise your entire IT environment. This is a serious issue your enterprise needs to take this seriously, and that starts with <\/span>employee training<\/span>. <\/span><\/p>\n

An Ounce of Prevention\u2026<\/b><\/h3>\n

Your IT security team needs to drill your employees on how to detect fake emails and what GDPR compliance will require of enterprises and consumers. Here are a few lessons your employees should absorb: <\/span><\/p>\n