Fact-finding survey on implementation and awareness of measures against targeted attacks at workplaces
A fact-finding survey was conducted with information systems administrators and employees in Japan.
Around 50% of administrators answered that training against targeted e-mail attacks resulted in an increase in the time it took to open e-mails or web pages, negatively affecting business productivity. There is an increased need for security measures that allow administrators and employees to freely browse e-mails and the web without worry.

Information security solution provider Digital Arts Inc. (headquartered in Chiyoda-ku, Tokyo, Japan, CEO: Toshio Dogu, hereinafter referred to as "Digital Arts," Code 2326) has conducted a fact-finding survey regarding awareness of targeted attacks at workplaces with 330 administrators and 1,105 employees responding.

In recent years, attacks targeting specific businesses and organizations, particularly via e-mail, are on the rise, and in 2018, Japan’s National Police Agency noted that the number of cyber-attacks was the highest ever recorded, and that the threat against institutions is continuing to grow. In this situation, for businesses one of the main measures being taken against these kinds of attacks is training against targeted attack e-mails. Digital Arts has listened to information systems administrators and employees regarding the status of implementation and overall awareness of these measures.

In this survey, 59.1% of administrators said that they are experiencing issues with their company’s web and e-mail, and of those, 73.8% answered that they have given up on finding a solution. It is estimated that because security measures such as multilayered protection solutions are being implemented but are not solving the issues, there is a shift toward raising employees’ security awareness in the form of targeted attack e-mail training.

71.8% of companies are implementing some form of training as a measure against targeted attack e-mails. Both information systems administrators and employees responded that employee education and training within the company was more effective than the implemented product, and that the accumulated trainees’ knowledge was beneficial. This shows that employee training, including targeted attack e-mail training, is providing measurable results.

At the same time, 30.8% of system administrators responded that the training e-mail results affected their employee assessment. Because of this, around 50% felt that the time it took to confirm the safety of and open a single e-mail with a single URL was getting longer compared to before, and 80% of those felt that it was taking around twice or 3 times as long. This is estimated to be because the results are inversely proportional to how thorough the training is, and this can be seen to be negatively affecting business productivity. Also, 21.0% of employees and nearly a third of administrators have experienced opening either a training e-mail or questionable e-mail without realizing, and this is estimated to be because companies are not taking measures such as conducting training or issuing warnings (or there is no awareness of these) which are leaving these problems to go unnoticed.

Web and E-mail Situation

• 59.1% of information systems administrators are experiencing issues with their companies’ web and e-mail situation, and of those 73.8% have given up on finding a solution.

Targeted attack e-mail training

• 71.8% of companies and organizations have implemented targeted attack e-mail training as a measure against targeted attacks.
• More than half of both information systems administrators and employees believe in-company training is more effective, and responded that the training is "beneficial in that it is accumulating trainees’ knowledge." Half of the system administrators feel that the implementation of the product has been effective.
• In cases where an employee opened a targeted attack e-mail, around half of administrators impose some sort of follow up training or issue a warning to the employee, and among those 30.8% responded that the result affects their employee assessments.
• At the same time, 32.7% of employees were not aware of how their company would respond in the case of a targeted attack e-mail being opened.
• 21.0% of employees have experienced opening a training e-mail or other unknown e-mail, however many have not undergone training or received any warnings, and there is the possibility that many may have opened these e-mails without realizing what they were.
• Of those who responded that the time it took to confirm whether an e-mail was safe became longer after implementing targeted attack e-mail measures, around 70-80% of administrators and more than 80% of employees responded that it was taking twice or 3 times as longer.

Distinguishing suspicious web pages and e-mails

• For 60% of respondents, the sender’s e-mail address and the e-mail subject were the factors examined in determining if an e-mail is suspicious.
• 60-70% of respondents determined that they look at the domain to judge whether a URL or web page was suspicious.
• Around half of the system administrators used information from co-workers and others.
• Regarding the response taken when a suspicious URL or web page was opened, similar to targeted attack e-mail training, around half of the system administrators take some action with the offending employee, such as providing education or issuing a warning. Meanwhile, 80% of regular employees in this case answered "Nothing in particular/I don’t know," highlighting a gap between the understanding of administrators and regular employees.