When it comes to protecting your business from cyber security threats, one of the hardest elements to manage is often the human factor. You can spend all the money in the world on the latest antimalware and antivirus software, intrusion detection and prevention systems, and advanced firewalls, but all it takes is one person to send an email to the wrong person, or misplace a password they've written down, and all that hard work could be undone.
Hackers are well aware of this, which is why social engineering attacks are one of the most popular ways of gaining access to networks or sensitive information. You can think of protecting your networks the same way you protect your building. Criminals who want to break in could spend their time studying blueprints for a weak spot or trying to pick the locks, or they could hang around the back entrance wearing a hi-vis jacket with a clipboard in their hand, and wait for someone to hold the door open for them.
It's much the same in the virtual world, and one of the most popular attack avenues for hackers is the use of phishing, or increasingly, it's more targeted cousin: spear phishing.
Often, this consists of a link to a fake website enticing users to enter their login details, which hackers can then reuse elsewhere to gain entry. However, it could even be set up to trick employees into responding directly with sensitive data, perhaps by posing as a colleague claiming to need certain information for a meeting.