In this week’s featured article, which is the first of two parts on what is a huge subject for businesses to tackle, we take a look at some of the important issues of email security and how businesses can try to strengthen this crucial area of their cyber-defences.
Most Breaches Involve Email
Over 90 per cent of breaches now involve email, and Proofpoint’s Annual Human Factor Report figures, for example, show that social engineering is strongly favoured as a way in by cyber criminals. 99 per cent of these email attacks rely on victims clicking links.
Statistics like these reveal some of the key challenges that businesses and organisations face on a daily basis, such as how to defend effectively against the whole range of email attacks, how to spot and eliminate threats as they arrive, and how to ensure that staff are aware of email threats and know what to do when faced with suspicious emails and links.
Types of Email-Based Attacks
There is a vast array of attacks launched through email systems (often relying on social engineering) including targeted phishing schemes, business email compromises, and ransomware attacks.
– Ransomware is still a popular attack and extortion method, and Trend Micro reported a 77 per cent surge in malware attacks during the first half of 2019.
– Phishing is a cheap, easy and highly effective method for criminals to gain access to company systems, steal important data and money, and create a cornerstone of all kinds of other hacking campaigns. Just some of the high profile examples from the news this year include fake voicemail messages being used to lure victims into entering their Office 365 email credentials into a phishing page, Thomas Cook customers being targeted by phishing attacks in the wake of the travel company going into receivership, and news of Lancaster University being hit by a large, sophisticated phishing attack aimed at grabbing the details of new student applicants.
Verizon’s 2019 Data Breach Investigations Report showed that 32 per cent of data breaches involve phishing. Phishing threats to businesses are also evolving and becoming more sophisticated all the time. For example, PhishLabs recently discovered a tactic whereby attackers used a malicious Microsoft Office 365 app to gain access to a victim’s account without the need for the account holder to give up their credentials to the attackers – worrying!
The National Cyber Security Centre offers advice on how to protect your business/organisation from phishing attacks here: https://www.ncsc.gov.uk/guidance/phishing.
There are also a number of phishing test sites available online so that you (or staff members) can see if you’re able to spot a phishing email.
– Malware attachments to emails. There are a now staggering amount of malware types that businesses and organisations have to protect themselves against. For example, over 800 million different types were encountered in 2018, and some commentators are predicting that variants will reach over 1 billion by 2020!
A Number of Sources
Email-based attacks aren’t simply targeted just at your email system in a straightforward way but could come from sources such as supplier email systems that have been compromised or they could use details stolen from breaches elsewhere as part of the campaign.
Protecing Your Business Against Email Threats
There are many ways that you can try to protect your email system from email attacks and try to minimise the risk of human error that is so important in social engineering attacks. These include:
Help From the Big tech Companies :
Microsoft
Microsoft offers a number of ways that businesses and organisations can help keep their email secure, such as:
– Outlook’s Junk Email Filter, and the Report Message add-in for Outlook.
– Office 365’s Advanced Threat Protection (ATP) plans which offer a variety of leading-edge tools to investigate, understand, simulate, and prevent threats.
– Secure Score for Office 365 – a way to measure and get suggestions about how to protect your business from threats, all through a centralised dashboard.
– The “campaign views” tool in Office 365 that is designed to offer greater protection from phishing attacks by enabling businesses to be able to spot the pattern of a phishing campaign over individual messages.
More information: The Microsoft blog here gives 6 email security best practices to protect against phishing attacks and business email compromise: https://www.microsoft.com/security/blog/2019/10/16/top-6-email-security-best-practices-to-protect-against-phishing-attacks-and-business-email-compromise/
Google also offers a number of tools and suggestions, including:
– Advanced security settings for G Suite administrators to protect against phishing and malware (find out more here: https://support.google.com/a/answer/9157861?hl=en).
– Offering steps to identify compromised accounts (see https://support.google.com/a/answer/2984349?hl=en&ref_topic=2683865).
– Advice on Firewall settings.
You may, of course, already be using another email protection system.
Other Advice
Advice about ways in which you can protect your company now from email-based attack such as phishing and malware attacks is widely available, and in addition to the measures already covered (e.g. using Microsoft security tools), some basic measures that companies take include:
– Always keeping anti-virus and patching up to date.
– Staff education and training e.g. how to spot suspicious emails and what to do/what not to do e.g. not to click on links from unknown sources.
– Disabling HTML emails if possible (text-only emails can’t launch malware directly).
– Encrypting sensitive data and communications as an added layer of protection.
– Getting into the routine of checking your bank account’s activity for suspicious charges.
– Making sure important and sensitive company data is backed up and including business email compromise (BEC) in business continuity planning and disaster recovery planning.
– Preventing email archives from being publicly exposed e.g. by making sure that archive storage drives are configured correctly.
– Monitoring for any exposed credentials (particularly those of finance department emails).
– Using two-Factor Authentication (2FA) where possible, and enterprise users may wish to block .html and .htm attachments at the email gateway level so that they don’t reach members of staff, some of whom may not be up to speed with their Internet security knowledge.
– Not using the same password for multiple platforms and websites (password sharing). This is because credentials stolen in one breach are likely to be tried on many other websites by other cyber criminals (credential stuffing) who have purchased/acquired them e.g. on the dark web.
Looking Forward and Getting Prepared
In today’s environment, attackers can adapt their campaigns and methods so quickly, and use methods that can evade the more common protection solutions (‘polymorphic’ attacks) that businesses and organisations find themselves in a position whereby known signature and reputation-based checks aren’t enough, and that they need to be able to get a fuller picture and find solutions that can focus effectively on zero-day and targeted attacks in addition to known vectors. Looking forward, there is also the future threat of AI machine-learning software being able to possibly generate phishing URLs that can beat popular security tools, and of the threats posed (further in the future) buy the possible use of quantum computers in cyber attacks, and these are subjects that we will look briefly in part 2 of our look at email security. For now, stay safe.
