• Search for:
    30May, 2023
    What the Email Security Landscape Looks Like in 2023

    Email-based threats have become increasingly sophisticated, how is changing the Email Security Landscape?

    For over a decade, email has been a common source of cybersecurity threats. During that time, email-based threats have become increasingly sophisticated. What started as notes from Nigerian princes that needed large sums of money to help them get home has evolved into bad actors that use refined social engineering tactics to convince the receiver to unknowingly share important information. It’s not likely to stop there.

    Recently, VIPRE Security Group published their Email Security in 2023 report, where they shared insights on the development of email-based threats and how they can impact organizations. What follows is an overview of some of the key findings from the report and some of the thing’s businesses can do to protect their employees and data.

    Email Threats Are Becoming More Sophisticated

    There are a number of ways that email can be leveraged to compromise the security of an organization, but the most prominent approach is phishing. In a phishing attack, an individual receives an email from a sender that seems legitimate with a request to share information, log into a system, or click a link. In this email, the bad actor pretending to be the sender may nefariously capture the individual’s authentication details or prompt a malicious download that then compromises the system. At this point, the bad actor has access to the information they were after.

    Today, according to the Verizon 2022 Data Breach Investigation Report, phishing is one of the leading five tactics used to initiate data breaches. It’s a trend that’s growing. In 2022, email phishing attacks made up 24% of all spam emails — up from 11% in 2021. Given that phishing requires a relatively low lift for attackers, and has a fairly decent rate of return for them, it’s no surprise that there has been an increase in this trend.

    The prevalence of phishing attacks has been bolstered by a number of risk factors, including:

    • Insider threats whereby disgruntled or compromised employees leverage their position in the company to get access to certain items. They can use their corporate email and their insider knowledge to make requests to others using social engineering.
    • Domain compromise, where attackers compromise a website or newly registered domain to create seemingly legitimate communications and links.
    • Phishing-as-a-Service has emerged as a model that’s standardizing the underground economy and making it easier for bad actors to access phishing and hacking services.
    • QR code spoofing. Bad actors are starting to leverage QR codes as part of their email phishing tactics, largely because of how comfortable people got with them over the pandemic.
    • Domain warming, a process through which someone creates a positive reputation for a domain so that its emails don’t get flagged as spam. Bad actors use the domain until it starts getting blocked, and then move onto the next one.

    What Can We Expect in 2023?

    As part of their report, the team at VIPRE made three predictions for the email security landscape this year.

    #1 There will be more remote work-based attacks. Since remote work relies significantly on email as a form of communication, the statistical chance of a successful phishing attack only goes up. In addition, there is also a number of collaboration tools — like Asana, Slack, and Teams — that leverage email as a verification method, and that could be compromised.

    #2 The “as-a-Service” economy is going to keep growing. Cybercriminals are finding out that they don’t need to be technical experts to execute their campaigns anymore. Now they can hire a team to do it for them. The potential of this growing space is dangerous, and companies need to stay on their toes.

    #3 Small businesses are at risk. As bad actors opt for a more agile and efficient approach, they’re turning their attention to “easy” targets: small businesses. As large enterprises focus more on security, they are getting harder to penetrate, and smaller companies require less effort to infiltrate. This ultimately makes them more valuable to hackers.

    Being aware of the threats is an important first step, but organizations need to also be well-positioned to protect themselves from these activities.

    What Companies Can Do to Protect Themselves

    Just as the email threat landscape has evolved over the last decade, the same is true for email security. Today, companies have a wealth of options to choose from when it comes to strengthening their email security posture. These include:

    • Implementing a layered email security strategy that accounts for different types of phishing attacks and dissuades bad actors from attempting an attack.
    • Investing in behavioral-driven analytics so that they can quickly identify any red flags and respond to a behavioral anomaly before it causes any real impact.
    • Securing data in transit to avoid sensitive data being captured in email responses. This can be done using encryption.
    • Deploying email-specific security controls that go beyond traditional security methods, such as dynamic crawl abilities.
    • Protecting all endpoints by building a comprehensive security posture and reviewing all files, processes, and network activity proactively.
    • Training users to be more aware. Education is a key element in building a culture of security, so it’s vital to get employees onboard when rolling out new standards and policies.

    There’s no time like the present to get started with these strategies. Investing in best-in-class systems now will ensure that you’re keeping pace with the ongoing evolution of email threats and keeping your company protected.

    Resource : https://securityaffairs.com/146141/hacking/email-security-landscape-2023.html

    13Mar, 2023
    AI is taking phishing attacks to a whole new level of sophistication

    92% of organizations have fallen victim to successful phishing attacks in the last 12 months, while 91% of organizations have admitted to experiencing email data loss, according to Egress

    Not surprisingly, 99% of cybersecurity leaders confess to being stressed about email security. Specifically, 98% are frustrated with their Secure Email Gateway (SEG), with 53% conceding that too many phishing attacks bypass it.

    “The growing sophistication of phishing emails is a major threat to organizations and needs to be urgently addressed,” said Jack Chapman, VP of Threat Intelligence, Egress. “The signature-based detection used by Microsoft 365 and secure email gateways (SEGs) can filter out many phishing emails with known malicious attachments and links, but cybercriminals want to stay one step ahead. They are evolving their payloads and increasingly turning to text-based attacks that utilize social engineering tactics and attacks from a known or trusted source, such as a compromised supply chain email address.”

    “Unfortunately, phishing attacks will only become more advanced in the future, as cybercriminals use AI-powered technologies, such as chatbots, to automate and improve their attacks, such as adding video and voice capabilities to text-based phishing,” Chapman concluded.

    Inbound and outbound email security

    The report investigates both inbound phishing attacks and outbound data loss and exfiltration, highlighting the importance of a holistic approach to email security.

    Interestingly, 71% of surveyed cybersecurity leaders view inbound and outbound email security as a unified issue to tackle, recognizing their interconnected nature. The survey goes on to examine the technical controls and security awareness and training (SA&T) programs in place to reduce email security risk.

    Sophistication of phishing emails cause major financial losses

    86% of surveyed organizations reported that they were negatively impacted by sophistication of phishing emails, and 54% suffered financial losses due to customer churn following a successful phishing attack.

    Additionally, 40% of incidents resulted in employees leaving the organization. Cybersecurity leaders found that 85% of successful account takeover (ATO) attacks began with a phishing email.

    Risky behavior lead to costly data loss

    The survey found that people making mistakes or taking risks to accomplish their tasks are more common than malicious insiders. In fact, 91% of cybersecurity leaders surveyed reported that data had been leaked externally by email.

    The top three causes for these incidents include reckless or risky employee behavior, such as transferring data to personal accounts for remote work, human error, including employees emailing confidential information to incorrect recipients, and malicious or self-serving data exfiltration, such as taking data to a new job.

    Furthermore, 49% of organizations surveyed experienced financial losses from customer churn following a data loss incident, and 48% of incidents resulted in employees leaving the organization.

    Too many phishing emails bypassing employee inboxes

    58% of cybersecurity leaders believed their SEG was not effective in preventing employees from accidentally emailing the wrong person or with the wrong attachment.

    Additionally, 53% of respondents reported too many phishing emails still made it to employees’ inboxes, while 50% of organizations found it takes a lot of administrative time to manage their SEG.

    Security awareness and training

    Although 98% of the surveyed organizations conducted some form of Security Awareness and Training (SA&T), 96% of them expressed concerns or limitations with their SA&T programs.

    59% of organizations reported that SA&T is necessary for compliance with regulations or cyber insurance, and 46% of organizations reported that employees tend to skip through SA&T as fast as possible.

    Additionally, 37% of organizations admitted they lack confidence that employees remember what they have been taught during SA&T, and 29% of organizations reported that employees find SA&T to be annoying.

    Email security is a necessity for stoping phishing attacks

    The report highlights that people need real-time teachable moments that alert them to threats and engage them at the point of risk to tangibly reduce the number of security incidents that occur.

    Data throughout the report highlights that advanced email security is a necessity for everyday business. Despite investments in traditional email security and SA&T, surveyed organizations remain highly vulnerable to phishing attacks, human error, and data exfiltration.

    The only way to change the situation is to use intelligent email security solutions that augment traditional SEGs and Microsoft 365, offering the defense-in-depth required with a layered security approach.

    Resource : https://www.helpnetsecurity.com/2023/03/08/sophistication-of-phishing-emails/?web_view=true

    19Oct, 2022
    What are the top 3 email threats today?

    Security was never at the forefront of email design; as a service, email is intended specifically for the sharing of information. For threat actors, email has been a consistent, primary vector for attacks on organizations. From ransomware to phishing scams to business email compromise (BEC) attacks, email is a vulnerable resource that is typically critical for an organization’s infrastructure.

    Here are the top three email-based threats, what they have in common and how you can protect your organization.

    The common thread

    Email-based attacks fall into three broad categories based on methods and goals: phishing, social engineering and malware infection. Each attack can be carried out by other means, such as phone calls, text messages or malicious websites. But email messages remain a convenient and reliable vector for attackers, who often combine two or more of these types of attacks to increase their chances of success.

    Most successful email-based attacks have something in common. They generally involve email spoofing, which is when an attacker fakes the sender’s address to make it seem like an email message comes from a trustworthy sender. You’re more likely to click on a link or open an attachment when you think it comes from someone you know or a company you trust.

    Spoofing is not an attack itself but a means to an end. Fortunately, technological defenses against spoofing called DKIM, DMARC and SPF are free and widely available. Implementing them will go a long way toward making your organization’s email communications, both incoming and outgoing, more secure. You can read more about these defenses against spoofing in our article “How to: Fresh strategies to secure email.”

    Phishing

    Phishing is the most common email threat and the one that’s least likely to disappear with time. It tricks you into handing over private bits of information such as account usernames, passwords, email addresses, credit-card numbers or Social Security numbers.

    The phisher fools you by using technology to impersonate a trustworthy entity, which can be a well-known company or a workplace colleague. Malware is rarely involved, and there’s little personal interaction. The best phishing scams blend into your daily routine so that you never notice anything is wrong.

    In an email-security study conducted by CyberRisk Alliance in early 2022, 60% of CISOs and other IT managers surveyed cited phishing and spoofing as among their top three email-security concerns, right behind ransomware. And Microsoft in July 2022 found that a phishing campaign had targeted 10,000 companies with the aim of committing BEC attacks.

    In the most common scenario, a phisher’s email message tells you there’s something wrong with one of your accounts and that you need to log in immediately. The message includes what seems to be a link to the account login page but is really a clever mockup. As soon as you type in your credentials, the attacker has them.

    Phishing can also be done via SMS text messages, in which case it’s called “smishing,” or through voice calls, i.e. “vishing.” But phishing first arose with email messages, which are still the primary vector of attack.

    Targeted phishing attacks aimed at a single person or a small group of people, such as company executives or human-resources or IT staffers, are called “spear phishing.” In these cases, attackers often research their targets beforehand and personalize the malicious messages to make them more likely to succeed.

    “They are no longer sending one-size-fits-all,” said one CISO interviewed by CyberRisk Alliance. “They are researching people to target and tailor their approach to increase the likelihood of a successful attack.”

    While anti-spoofing defenses like DMARC will greatly reduce the number of phishing messages that reach your staffers, they won’t stop them all. If an attacker gets access to an employee’s internal network account, possibly by spear phishing, then they can send phishing emails to other staffers that genuinely come from that employee’s account.

    Your correspondent once fell for an email that seemed to come from an HR staffer and asked all staffers to address a payroll issue. A link in the message led to what looked like the Office 365 login page. Antivirus software blocked the site for some staffers, but other employees weren’t so lucky and had their paycheck direct deposits rerouted to other bank accounts.

    Aside from anti-spoofing protocols, protections against phishing are numerous. Endpoint protection, antivirus software and web browsers block known malicious websites. Multi-factor authentication (MFA) can prevent account takeovers even if a username and password are successfully phished.

    Just as important, however, is employee training. Teach your staffers about how to watch out for phishing attacks and what to do if they fall for one. None of these methods is foolproof, but by combining them you’ll greatly increase your email-security stance.

    “Employees are able to recognize and flag fraudulent emails because we see that in analytics and test them thru simulated phishing emails,” a CISO working in the tech sector told CyberRisk Alliance. (Read more about next-generation training in our eBook, “Don’t Call It Training: Achieving Cyber Resilience Through Workforce Optimization.”)

    BEC and other forms of social engineering

    Social engineering is a new name for old-school confidence tricks that don’t always involve technology. If you’ve ever talked your way into an exclusive party or event you weren’t invited to, that’s social engineering. So are Ponzi schemes and the well-worn “Nigerian prince” advance-fee scam.

    Today, crooks are using high-level social engineering to carry out business email compromise (BEC) attacks, aka “CEO fraud.” They impersonate company CEOs or CFOs and convince employees to pay phony invoices or make wire transfers to random bank accounts. The attacks usually include spoofing and may be facilitated by phishing, but do not generally involve malware; the goal is money.

    BEC attacks can be done in a number of ways, including by sending text messages to staffers after hours (not many people will recognize their CEO’s cellphone number) or by dialing into video conferences.

    “In those meetings, the fraudster would insert a still picture of the CEO with no audio, or a ‘deep fake’ audio through which fraudsters, acting as business executives, would then claim their audio/video was not working properly,” said the FBI in its 2021 Internet Crime Report.

    But the most common vector for BEC attacks is via email. Often, the attackers compile lists of company employees authorized to make payments, which can be obtained from LinkedIn or company websites or harvested by information-stealing malware.

    Then the attackers target employees with spoofed emails that seem to come from the boss and demanding urgent wire transfers to a specific companies or bank accounts. If the employees who get the emails believe the scam and can make the payments, then the money may be gone for good.

    The FBI estimates that U.S. businesses and individuals lost $2.4 billion to BEC scams in 2021, with losses rising 65% from July 2019 to December 2021. The worldwide cumulative damage since June 2016 reached $43 billion.

    “It’s the BEC attacks that are rising most dramatically,” one CISO told CyberRisk Alliance. Another cited “a strange email saying our sales VP authorized this payment invoice” that amounted to “a few ten thousands” of dollars, and thwarted only when an accountant double-checked with the sales VP.

    Anti-spoofing technologies will help reduce BEC emails, as will company policies that mandate multiple staffers signing off on large payments. Again, you may get the best results by training employees to spot BEC attempts, although some may need more training than others.

     “We have a mixture of older and younger employees; the younger employees tend to recognize phishing emails more than our older employees,” a CISO in the education sector told CyberRisk Alliance.

    This training will also cut down on other forms of social engineering, such as when a trusted supplier suddenly seems to demand payment of an overlooked invoice.

    However, a CISO in business and professional services said that even with training sessions, some staffers “still click on things they shouldn’t, open up emails or attachments when they shouldn’t.”

    “If they don’t get a big red warning from the security systems,” the CISO added, “they just don’t think about every email they touch.”

    Malware and booby-trapped attachments

    In 2011, a large information-security vendor was hit by Chinese state-sponsored attackers who sent email messages to just a few people in the company, spoofing addresses so that the staffers seemed to be emailing each other. Attached to the messages was a Microsoft Excel file that exploited a previously unknown vulnerability in Adobe Flash and gave the attackers full control of the employees’ machines.

    The attackers used that access to penetrate the vendor’s networks and compromise its leading security product, which was used by U.S. defense contractors and thousands of other organizations to protect their networks. The security company had to make good with its clients and took a $66 million charge as a result of the attack.

    Email-delivered malware is perhaps the most dangerous email threat of all. It can deeply penetrate an organization’s systems, quietly stealing information for months or even years. If the goal is money rather than information, then it can install ransomware that locks up those systems and demands payment to free them or steal proprietary data and ransom that too.

    Such malware often comes in the form of an attachment that looks innocuous, like an invoice or a resume. The accompanying message may urge that the attachment be opened immediately. In other cases, the message contains a link that takes the recipient to a website that silently tries to install malware through a web browser.

    Aside from anti-spoofing measures, the best defenses against email-borne malware are strong endpoint protection software that automatically scans all email attachments, regular application and operating-system updates, and strict network segmentation and identity and access management (IAM) policies.

    And of course, you should train your employees to be suspicious of emails that come from outside the company — and sometimes those that come from inside as well.

    “We have trained our users to be very paranoid and not only to delete suspicious emails but to be very proactive about reporting suspicious emails,” one CISO told CyberRisk Alliance. “Every user is incredibly skeptical about anything that is even halfway sketchy.”

    Resource : https://www.scmagazine.com/resource/email-security/what-are-the-top-3-email-threats-today