[et_pb_section fb_built=”1″ _builder_version=”4.27.4″ _module_preset=”default” custom_padding=”||14px|||” global_colors_info=”{}”][et_pb_row _builder_version=”4.27.4″ _module_preset=”default” locked=”off” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https:\/\/nationalcybersecuritysociety.org\/wp-content\/uploads\/2025\/09\/NCSS-3397-Bulletin-Header-Footer-Header-Graphic-1600×350-Compressed.png” title_text=”NCSS-3397-Bulletin-Header-Footer-Header Graphic 1600×350-Compressed” _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n
Published: December 15, 2023<\/em><\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n Our new bulletin Cyber Threat Watch<\/em><\/strong> has been created to help small businesses stay up to date on the latest threats, news, and events affecting their business. The content has been curated to make cybersecurity easy and accessible for both technical and nontechnical readers.<\/span><\/p>\n [\/et_pb_text][et_pb_heading title=”Featured Cyber News \u2014 Phishing” _builder_version=”4.27.4″ _module_preset=”default” title_level=”h2″ title_font=”|600|||||||” title_text_color=”#00688E” global_colors_info=”{}”][\/et_pb_heading][et_pb_image src=”https:\/\/nationalcybersecuritysociety.org\/wp-content\/uploads\/2025\/09\/AdobeStock_38355335-scaled-e1756839033613.jpeg” title_text=”Lockangebot” _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n Phishing exploits are the leading cybercrime as reported by the FBI (IC3) for 2022, and 2023 is projected to eclipse previous years\u2019 stats. Social engineering, particularly through phishing, remains a prevalent method for malicious actors to compromise systems and networks, typically through email and deploying malware.<\/p>\n Are we prepared? Probably not. The NCSS believes now is the time for businesses to develop and implement a dedicated, comprehensive anti-phishing program\u2014wherein all users are educated on the severe threat posed by phishing, enabled to identify social engineering red flags, and prevented from being the next victim.<\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”1_4,3_4″ _builder_version=”4.27.4″ _module_preset=”default” custom_padding=”0px|||||” global_colors_info=”{}”][et_pb_column type=”1_4″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https:\/\/nationalcybersecuritysociety.org\/wp-content\/uploads\/2025\/09\/AdobeStock_78636149-scaled.jpeg” title_text=”Phishing Scam Warning Sign” _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][\/et_pb_column][et_pb_column type=”3_4″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n This bulletin includes exemplars from leading experts. DHS (CISA) recently released a new guide, Stopping the Attack Cycle at Phase One<\/em><\/strong>, a comprehensive guide on phishing<\/a>. At the core of the guide is a repeatable employee training program.<\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.27.4″ _module_preset=”default” custom_padding=”0px|||||” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” custom_margin=”0px|||||” global_colors_info=”{}”]<\/p>\n Another tool developed by KnowBe4, Social Engineering Red Flags<\/em><\/strong> (see here<\/a>), can be shared with all employees and their partners\u2014customers, suppliers, and their extended network.\u00a0<\/p>\n NIST\u2019s contribution to this body of knowledge is The NIST Phish Scale<\/em><\/strong>\u2014a methodology to rate an \u201cemail\u2019s phishing detection difficulty\u201d as part of a cybersecurity awareness and phishing training program. To utilize this free resource, see this link available from NIST<\/a>.<\/p>\n [\/et_pb_text][et_pb_image src=”https:\/\/nationalcybersecuritysociety.org\/wp-content\/uploads\/2025\/09\/AdobeStock_132339495-scaled.jpeg” title_text=”Hacker With Log On Screen,Computer Fraud Concept Background” _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” custom_css_free_form=”ol {|| list-style: none !important; || counter-reset: item; ||}||||ol li {|| counter-increment: item; || position: relative; || padding-left: 2em; \/* Adjust as needed for spacing *\/||}||||ol li::before {|| content: counter(item) %22.%22; || font-weight: bold; || position: absolute;|| left: 0; || width: 1.5em; || text-align: right;||}” global_colors_info=”{}”]<\/p>\n In addition to improving our knowledge of phishing, businesses need to enable multi-factor authentication (MFA) across multiple platforms. <\/em><\/strong>A strong password can only get you so far. MFA or two-factor authentication (2FA) is a simple step in hardening the defenses against criminal activities.<\/p>\n The NCSS and our industry partners (Nonprofit Cyber<\/a>) are working to share tips and tools to improve our global security. The #MoreThanAPassword<\/em><\/strong> campaign was recently designed to encourage users to take advantage of these simple steps:<\/p>\n Lastly, phishing attacks often exploit weak MFA implementations. Despite the security enhancements MFA offers, it can be vulnerable if not configured correctly. We recommend you leverage Managed Security Service Providers. We have partners who can help, here<\/a>.<\/p>\n It is crucial that all stakeholders be educated about phishing, which involves malicious actors posing as trustworthy sources to trick victims into interacting with malicious links or email attachments. The consequences of such attacks can range from initial access and data theft to system damage, reputational harm, privilege escalation, and\/or service disruption. We hope you found this bulletin helpful and consider becoming a member. Membership sign-up can be found here<\/a>.<\/p>\n For more information about NCSS tips and tools, see our Small Business page<\/a> or visit www.nationalcybersecuritysociety.org<\/a>.<\/p>\n <\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.27.4″ _module_preset=”default” locked=”off” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_divider _builder_version=”4.27.4″ _module_preset=”default” custom_margin=”||-2px|||” locked=”off” global_colors_info=”{}”][\/et_pb_divider][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” header_2_text_color=”#00688E” hover_enabled=”0″ global_colors_info=”{}” header_2_font=”|600|||||||” sticky_enabled=”0″]<\/p>\n https:\/\/www.cisa.gov\/sites\/default\/files\/2023-10\/Phishing%20Guidance%20%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf<\/a><\/p>\n https:\/\/www.knowbe4.com\/hubfs\/Social-Engineering-Red-Flags.pdf<\/a><\/p>\n\n
– Phishing-resistant MFA: Enable MFA, particularly for privileged accounts, that are often associated with system administrators, executives, or other high-level roles who have elevated access rights to sensitive systems and data.<\/li>\n
– Use passkeys\u2014that leverage cryptography<\/li>\nReferences<\/h2>\n