Email Security

In this tech insight, we take a look at the many threats to email security that businesses face and what businesses can do to mitigate them, together with what help is available to help tackle those threats effectively.

Email Accounts For Most Security Breaches

Prioritising email security is important because most cyber-security breaches involve email, with social engineering a strongly favoured tactic favoured by cyber-criminals and 99 per cent of email attacks relying on victims clicking links (Proofpoint Annual Human Factor Report).

Types of Email-Based Attacks

The many different types of email attack threats that businesses face include targeted phishing schemes, business email compromises, and ransomware attacks. For example:

– The Check Points mid-year security report in August this year showed that ransomware attacks (for extortion) have increased dramatically over the past year, with 93 per cent more attacks carried out in the first half of 2021, and with ransomware now appearing in 10 per cent of breaches (Verizon).

– Phishing. This cheap, easy, and highly effective tactic uses emails purporting to be from reputable sources containing links that (if clicked-on) direct the victim to pages where payment and other personal data is stolen or malware is downloaded. For example, at the end of 2019, Thomas Cook customers were targeted by phishing attacks in the wake of the travel company going into receivership. Verizon’s 2021 Data Breach Investigations Report shows that phishing increased by 11 per cent from Aug 2020 to Aug 2021 and that phishing is present in 36 per cent of breaches. The National Cyber Security Centre offers advice on how to protect your business/organisation from phishing attacks here: https://www.ncsc.gov.uk/guidance/phishing.

– Malware attachments to emails. It is estimated that a business is targeted by a ransomware attack every 11 seconds (Kaspersky) and Between 2019 and 2020, ransomware attacks rose by 62 percent. Malware is now involved in over 70 per cent of system intrusion (Verizon). Common forms of malware include viruses, worms, Trojan Horses, spyware, adware, and ransomware. Remote Access Trojans (RATs), for example, are malicious programs that can arrive as email attachments and provide a ‘back door’ for administrative control over the target computer, and can be adapted to avoid detection and to carry other types of attack tactics including disabling anti-malware solutions and enabling man-in-the-middle attacks.

– BEC and VEC. Whereas Business Email Compromise (BEC) attacks have been successful at using email fraud combined with social engineering to bait one staff member at-a-time to extract money from a targeted organisation, security experts say that this kind of attack is morphing into a much wider threat of ‘VEC’ (Vendor Email Compromise). This is a larger and more sophisticated version which, using email as a key component, seeks to leverage organisations against their own suppliers.

– AI-based threats.  Many technology and security experts agree that AI is likely to be used in cyberattacks in the near future and its ability to learn and to keep trying to reach its target (e.g. in the form of malware) make it a formidable threat. Email is the most likely means by which malware can reach and attack networks and systems, so there has never been a better time to step up email security, train and educate staff about malicious email threats, how to spot them and how to deal with them. The addition of AI to the mix may make it more difficult for malicious emails to be spotted. The good news for businesses, however, is that AI and machine learning is already used in some anti-virus software (e.g. Avast) and this trend of using AI in security solutions to counter AI security threats is a trend that is likely to continue.

Protecting Your Email From Common Threats

Ways to protect your email from common security threats include:

– Always keeping anti-virus and patching up to date.

– Staff education and training; e.g. how to spot suspicious emails and what to do/what not to do, such as not clicking on links from unknown sources.

– Disabling HTML emails if possible (text-only emails can’t launch malware directly).

– Encrypting sensitive data and communications as an added layer of protection.

– Getting into the routine of checking your bank account’s activity for suspicious charges.

– Making sure important and sensitive company data is backed up and including business email compromise (BEC) in business continuity planning and disaster recovery planning.

– Preventing email archives from being publicly exposed; e.g. by making sure that archive storage drives are configured correctly.

– Monitoring for any exposed credentials (particularly those of finance department emails).

– Using two-Factor Authentication (2FA) where possible, and enterprise users may wish to block .html and .htm attachments at the email gateway level so that they don’t reach members of staff, some of whom may not be up to speed with their Internet security knowledge.

– Not using the same password for multiple platforms and websites (password sharing). This is because credentials stolen in one breach are likely to be tried on many other websites by other cyber-criminals (credential stuffing) who have purchased/acquired them (e.g. on the dark web).

Broad Methods and New Approaches

Other broader methods that companies can use to protect their email security include:

– Adopting a ‘zero-trust’, “never trust, always verify” approach to company cyber security. The control that administrators have, and the monitoring and alerting can help dramatically reduce risk, including with company emails.

– Moving from perimeter to pervasive email security, e.g. as suggested by Mimecast’s CEO Peter Bauer.  This involves dealing with threats to the perimeter, from inside the perimeter, and from beyond the perimeter, plus an API-led approach to help deliver pervasive security throughout all zones.

Tech Company Help

Ways offered by tech companies to help businesses and organisations keep their email secure include:

Microsoft

 Outlook’s Junk Email Filter, and the Report Message add-in for Outlook.

– Office 365’s Advanced Threat Protection (ATP) plans.

– Secure Score for Office 365 / Microsoft 365 Defender portal – a way to measure and get suggestions about how to protect your business from threats, all through a centralised dashboard – find out more here: Microsoft Secure Score | Microsoft Docs

– The “campaign views” tool in Office 365 that is designed to offer greater protection from phishing attacks by enabling businesses to be able to spot the pattern of a phishing campaign over individual messages.

– Offering online advice for protecting Outlook email accounts – see Help protect your Outlook.com email account (microsoft.com).

– Microsoft is making its plus addressing (disposable email address), custom email feature available to all Office 365 users by adding it to Exchange Online.

Google

Google also offers a number of tools and suggestions, including:

– Advanced Gmail security for phishing and malware for G Suite administrators  – see Advanced phishing and malware protection – Google Workspace Admin Help.

– Offering steps to identify compromised accounts – see Identify and secure compromised accounts – Google Workspace Admin Help.

– Advice on Firewall settings.

–  Blocking malicious emails before they reach email boxes.  For example, on its Cloud blog on 16 April 2020, Google reported that Gmail blocks more than 100 million phishing emails each day.

What Does This Mean For Your Business?

With so many types of attacks relying upon email as a way in (e.g. phishing), effective email security is vital. Businesses and organisations need to make sure that they are prepared to not just effectively defend against the whole range of email attacks but are be able to spot and eliminate threats as they arrive, and ensure that staff are aware of email threats and know what to do when faced with suspicious emails and links. Also, attackers adapt their campaigns and methods very quickly, and use methods that can evade the more common protection solutions (i.e. ‘polymorphic’ attacks) so businesses and organisations must find ways to get a fuller picture of the email threats they face and find solutions that can focus effectively on zero-day and targeted attacks in addition to known vectors. With the threat of AI-based attacks now on the horizon too, there has never been a more important time for businesses to take a very close look at what more they could be doing to maximise their email security.