Page 20 - GBC Fall English 2025 flipbook

breach, a total shutdown or a
ransomware attack. Without
awareness training, they cannot
possibly know how to defend
“your company’s” network and
computing systems. The training is
a low-cost high value method of
reducing your risk of cyber-attack
not to mention reducing the cost of
your insurance premiums at the
same time.
Managed Phishing Simulations
Hackers are getting increasingly
sophisticated in terms of the
methods they will use to launch a
phishing attack. Hackers use greed,
fear and curiosity to provoke an
action by an unassuming or
unaware staff member. They play
on human emotions to get their
attacks across the line.
There are the common variety
of phishing emails such as the
generic “email from the Prince of
Nigeria” type emails, to the more
elaborate phishing techniques such
as Spear Phishing, Whaling,
Business Email Compromise,
Vishing, Smishing and Quishing.
Since there are so many
variations of attacks, it is highly
unfair for one to expect that a staff
member would be able to detect
these and prevent an attack without
training and “testing”. This is the
purpose of managing phishing
attacks.
A phishing simulation is a
proactive cybersecurity technique
designed to test an organization’s
resilience against phishing attacks.
It involves creating simulated
phishing emails that mimic real-
world phishing attempts to
measure employee’s awareness
and their responses.
Providing training and
managed phishing simulations on
a regular and recurring basis are
two of the most effective and
affordable ways to lessen or reduce
the chances of a cyber-attack on
your club.
20
Golf Business Canada
Glossary
Quishing also known as QR code phishing, is a type of
cyberattack where malicious actors use QR codes to
trick individuals into visiting fraudulent websites or
downloading malware. These attacks exploit the
convenience of QR codes to bypass traditional security
measures like email filters, directing victims to fake
websites designed to steal sensitive information or
infect devices with malware.
Vishing is the fraudulent practice of making phone
calls or leaving voice messages purporting to be from
reputable companies in order to induce individuals to
reveal personal information, such as bank details and
credit card numbers.
Smishing is a type of phishing attack that uses SMS
(text) messages to trick individuals into revealing
sensitive information or downloading malware. It
combines the terms “SMS” and “phishing,” where
cybercriminals impersonate legitimate organizations or
individuals to lure victims into clicking malicious links or
providing personal details
Business Email Compromise (BEC), also known as “CEO
fraud” or “whaling,” is a sophisticated cybercrime where
scammers impersonate trusted individuals (like CEOs or
vendors) to trick employees into transferring money or
sensitive data. It is a type of email fraud that is on the
rise, with significant financial losses reported by
businesses.
Whaling security, also known as whale phishing, is a
specialized type of phishing attack that specifically
targets high-profile individuals within an organization,
such as executives or high-level managers, with the
goal of stealing sensitive information or money. These
attacks are more sophisticated than standard phishing
attempts and often involve extensive social engineering
to gain the target’s trust
Spear Phishing is a targeted form of phishing attack
where malicious actors send highly personalized emails
or messages to specific individuals or organizations,
aiming to trick them into divulging sensitive information,
installing malware, or making fraudulent money
transfers. Unlike regular phishing that casts a wide net,
spear phishing involves detailed research on the target
to make the attack more convincing and effective.