The U.S. faces hundreds of thousands of cyber attacks every day. It was recently reported that Russian government hackers have successfully infiltrated U.S. government infrastructure including nuclear facilities. U.S. power company systems have also been breached. These breaches could have huge and dangerous implications: hackers were not only collecting data, they were putting tools in place that would allow them to turn off the power in our country.

How did they get in?

Malware-Laden Email Attachments

You may think Russia has high tech capabilities and genius hackers, and surely they do, but many of these breaches were the result of successful phishing attempts! Hackers sent falsified resumes full of malware to government and power company employees. Once these attachments were opened, the malware was unleashed, collecting usernames and passwords that led to higher-level systems.

Workplace Photos

Hackers also downloaded employee photos from public human resources pages. When blown up to full resolution, the hackers were able to extract sensitive information from the background of these photos. Sensitive information included equipment models and status information. And while this data may not be classified or confidential on its own, it adds to a picture of our infrastructure that an adversary shouldn’t have.

This news is a serious reminder of just how seriously we all should take cyber security—our national security could depend on it. The government and power companies can block email from outside the country and put other controls in place such as non-reliance on digital controls, but this can be costly or inefficient. One inexpensive and low-tech solution is to educate users on cyber dangers. Train them and test them—a knowledgeable workforce can make all the difference.