Fall is here. The leaves are changing, Halloween decorations are appearing in yards, pumpkin spice is showing up in everything imaginable, and somewhere, some misguided person is probably trying to replace perfectly good buffalo wing sauce with pumpkin spice wing sauce. Sadly, it is also the time of year when scams and social engineering attacks start taking advantage of the season.
October is Cybersecurity Awareness Month, which makes this a great opportunity to talk about the threats we face and, more importantly, what we can do about them. While cybersecurity is something we should be thinking about all year, the changing seasons, holidays, shopping events, and charitable giving provide attackers with plenty of opportunities to make their scams seem timely and believable, and believable is exactly what they need.
Scammers Follow the Calendar Too
Cybercriminals understand something that marketers have known for years: timing matters. A phishing email about a package delivery is much more believable when people are doing a lot of online shopping. A fake charity request can be more effective when people are already thinking about giving. A message about an employee benefits change may get more attention during open enrollment. The truth is, the basic scam may not be new at all, the attackers simply change the wrapper to fit the mood.
This is one of the reasons social engineering continues to work. Attackers do not necessarily need to find some highly technical way to defeat a security system when they can convince someone with legitimate access to do the work for them. They may send a phishing email designed to steal credentials, impersonate an executive asking for an urgent payment, create a fake shopping site offering a deal that is just a little too good to be true, or pose as a charity asking for donations. Nothing is off the board, or out of bounds when it comes to lining their pockets. In each of these cases, like most any social engineering attack, the attacker is simply trying to get the victim to act before they stop and think about what is happening.
Why Seasonal Scams Work
Social engineering attacks often rely on emotion. Urgency, fear, curiosity, excitement and even generosity can influence how we make decisions. During the fall and heading into the holiday season, there are plenty of opportunities to trigger those emotions.
An unbelievable deal on something you have been looking for, or is in short supply during the holiday season, can generate excitement. A notice that an account is about to be locked creates urgency. A message claiming a package could not be delivered creates curiosity and concern. A request to help people affected by a tragedy appeals to generosity. While none of these emotions are bad, the problem is that cybercriminals know how to use them against us and do not care who they hurt in doing so.
When we are distracted, busy or emotionally invested in something, we are more likely to make quick decisions. Attackers want that quick decision because taking an extra few seconds to look at an email, verify a request, or visit a website independently can be enough to expose the scam.
Cybersecurity Awareness Month Is a Great Time for a Tune-Up
Cybersecurity Awareness Month should not simply mean sending employees an email reminding them not to click suspicious links, because security education works best when people understand why attackers do what they do and have practical experience recognizing the techniques being used against them.
Employees do not need to become cybersecurity experts, they do, however, need enough security savvy to recognize when something does not look right and know what to do about it. Obviously, we would not put someone behind the controls of a forklift without training them first, so we should not expect people to spend their entire workday using computers, email, collaboration platforms and cloud applications without teaching them how to use those tools safely either.
That training should include real-world examples where we show people what phishing messages actually look like, explain why attackers manufacture urgency, talk about business email compromise and impersonation scams, and most importantly, make reporting suspicious messages easy while encouraging people to report them. A reported phishing email or social engineering attack is potentially valuable threat intelligence, and if one employee reports an attack quickly, the security team may be able to remove similar messages before other employees see them or warn them to be on alert to strange phone calls, emails or text messages.
Do Not Make Humans Your Only Line of Defense
Education is extremely important, but cybersecurity has never been about finding one silver bullet. Organizations need layers of defenses that complement each other.
Email and communication filtering are critical and can significantly reduce the number of malicious messages that ever reach employees while endpoint security can help stop malware when something does make it through. Monitoring and alerting can help identify unusual activity and a well-practiced incident response plan can help minimize damage when something goes wrong.
Multi-factor authentication is another important layer. If an attacker manages to steal someone’s password through a seasonal phishing campaign or other data breach, MFA can make it significantly more difficult for them to turn those stolen credentials into account access, although it is not a silver bullet.
The same concept applies to financial transactions and sensitive information. For high-risk actions, organizations should consider requiring a second form of verification, especially when a request suddenly changes normal procedures. That is increasingly important as AI-generated impersonation and deepfakes make some social engineering attacks more convincing.
The key is layers and technology should help people, and people should provide another layer when technology misses something. Security awareness training, filtering, endpoint protection, MFA, monitoring, reporting and incident response all have different jobs to do.
Make Reporting Easy and Safe
One of the worst things an organization can do is to create a culture where employees are afraid to report mistakes. If someone realizes they clicked a suspicious link, entered credentials into a questionable website, or opened an attachment they should not have, the security team needs to know as quickly as possible because embarrassment and fear can turn a relatively small security incident into a very large one.
Employees should know exactly how to report something suspicious, and the process should be simple. A report-phishing button, security hotline, or clearly identified internal contact can save precious time.
Simulated phishing exercises are often misunderstood but can also help reinforce these behaviors when they are used to educate rather than embarrass people. The goal is not to catch employees doing something wrong, rather it should be done to give them experience spotting attacks and to build the habit of reporting suspicious activity. There is nothing like practice to build muscle memory and what is the brain other than just another muscle in our bodies.
Take Advantage of the Season
Cybersecurity Awareness Month gives organizations a natural reason to bring security back into the conversation, use it. Share examples of current scams, run short awareness sessions, talk about phishing and social engineering during team meetings, review how employees report suspicious activity, test incident response procedures, make sure MFA is being used where it should be, and do not forget to check that software and systems are being patched.
Do not just limit the conversation to the workplace either. The same people protecting organizational information during the day are dealing with fake delivery notices, shopping scams, account takeover attempts and fraudulent messages at home. Helping employees develop better cybersecurity habits benefits them personally as well, and that can make security awareness far more meaningful than another mandatory annual training module.
Enjoy Fall, but Stay Skeptical
Fall brings football (well the American version at least), Halloween, cooler weather, holiday shopping and an apparently endless supply of things somebody decided needed pumpkin spice added to them, but cybercriminals see something else: opportunity. This means they will continue adapting their phishing emails, fake websites, impersonation attempts and social engineering attacks to whatever people are thinking about at the moment.
Our job is not to make employees paranoid about every email or text message they receive. It is to help them develop a healthy sense of skepticism and give them the tools and knowledge to recognize when something is not right. Cybersecurity Awareness Month is a great time to reinforce those skills, review our defensive layers, and remind everyone that cybersecurity is not just the security team’s responsibility, we all have a part to play.
Now, about those pumpkin spice buffalo wings. Some things really should trigger an immediate security response.