Guarding Beyond the Gateway: Challenges of Email Security
Total Page：16
File Type：pdf, Size：1020Kb
Interested in learning more about security? SANS Institute InfoSec Reading Room This paper is from the SANS Institute Reading Room site. Reposting is not permitted without express written permission. Guarding Beyond the Gateway: Challenges of Email Security Learn how to maximize the trustworthiness of email services through changes to infrastructure and how to use your systems to improve the performance of the human firewall. Copyright SANS Institute Author Retains Full Rights Guarding Beyond the Gateway: Challenges of Email Security A SANS Whitepaper Written by Barbara Filkins January 2016 Sponsored by Mimecast ©2016 SANS™ Institute Introduction Email is often the first thing people check in the morning and the last thing they check in the evening. It is an essential communication channel in our business and personal lives, with more than 112 billion business emails being sent daily, according to a report by The Radicati Group.1 Almost half the time, employees (and more than half the time, executives) access their business email from mobile devices. A Business 2 Community article recently reported that 48 percent of all emails are now opened on mobile devices, and 64 percent of decision makers read their email via mobile devices.2 When accessing their email from all over the place (work, home or on the road), people Ubiquitous Email make mistakes and let in bad actors. Meanwhile bad actors, particularly phishers The average business user sends and that research their targets (known as spearphishers) are exploiting DNS weaknesses, receives 122 emails a day for a total malicious attachments and websites. For example, CNN Money reported in February that of 112 billion emails daily, according to the 2015 Email Statistics Study by a major infiltration of Russian ATMs started with spearphishing bank employees who The Radicati Group.5 clicked links in emails appearing to come from other bank employees.3 Targeted spearphishing attacks have become the method of choice for hackers as a result of the simplicity with which they can be unleashed and the effectiveness of their style as an attack. Hackers have learned it’s easier to exploit a network through its gullible and vulnerable users than to launch an attack against its hardened network defenses. To combat email-born attacks, organizations have deployed secure email gateways (SEGs) and security training for users. But now attackers are striking even more effectively with spearphishing and highly focused business email compromise (BEC) scams. One category of BEC scams aimed at high-level targets such as CFOs and CEOs is known as whaling or CEO fraud.4 These emails are so convincing that they can even bypass the secure email gateway because they appear to be from a trusted source with a proper subject line, the sending IPs are not on any blacklist and only a few emails are sent (so they don’t trigger alarms like mass phish scams would). To navigate this advanced attack landscape, organizations need to take the offensive beyond the gateway and adopt a 360-degree view of their email security operations. For this discussion, we concentrate on how to maximize the trustworthiness of email services through changes to infrastructure and how to use your systems to improve the performance of the human firewall. 1 Email Statistics Report, 2015-2019, The Radicati Group, www.radicati.com/wp/wp-content/uploads/2015/02/Email-Statistics-Report-2015-2019-Executive-Summary.pdf 2 “104 Fascinating Social Media and Marketing Statistics for 2014 (and 2015),” Business 2 Community, Dec. 2, 2014, www.business2community.com/social-media/104-fascinating-social-media-marketing-statistics-2014-2015-01084935#PBvlCHYbgZFZITrE.97 3 “What we know about the bank hacking ring - and who’s behind it,” CNN, Feb. 16, 2015, http://money.cnn.com/2015/02/16/technology/bank-hack-kaspersky/index.html?section=money_topstories 4 “FBI: $1.2B Lost to Business Email Scams,” Krebs on Security, Aug. 27, 2015, http://krebsonsecurity.com/2015/08/fbi-1-2b-lost-to-business-email-scams/ 5 Email Statistics Report, 2015-2019, The Radicati Group SANS ANALYST PROGRAM 1 Guarding Beyond the Gateway: Challenges of Email Security Targeted Attacks: Where the Threat Lies Email-related threats and breaches can be devastating to an enterprise. In August, the FBI warned that losses linked to business email compromises (BECs) totaled more than Phishing $1.2 billion from October 2013 to August 2015. Many industry experts say that estimate is Tricking users into giving likely low. sensitive information such Impacts can range from disruption of normal business functions (blacklisting of valid as usernames, passwords email, denial of service, data leakage) to regulatory sanctions, legal action, financial and credit card details (and loss and significant damage to reputation and brand confidence. The majority of sometimes, indirectly, money), costs associated with phishing exploits are due to loss of employee productivity and often for malicious reasons. uncontained credential compromises, which, when added to other factors, can cost an Phishing emails are generated average-sized company $3.77 million per year.6 in thousands without focusing on a specific victim profile.10 Spearphishing and Whaling They rely on creating a sense The infamous 2011 breach of RSA Security is almost a perfect example of a successful of urgency to encourage spearphishing exploit: It targeted human resources (HR) personnel with an email that had multiple people to click on their the subject line “2011 Recruitment Plan” and looked as if it originated from a recruitment malicious links or attachments. firm the HR department was familiar with. Only eight emails were sent, but one person As one SANS advisory board in HR opened the Excel attachment titled “2011 Recruitment Plan.xls.”7 The SecurID fiasco member put it: “People fall for cost RSA $66 million, including costs to replace tokens, monitor customers and handle phishing scams … because other fallout.8 they’re aimed at weak points in In another case, the cyberespionage group Pawn Storm (also known as APT28, Sednit, our psychology: the perception Fancy Bear, Sofacy and Tsar Team) mounted a campaign against Ministries of Foreign of scarcity (Act now!), authority Affairs worldwide. In October 2015, this group of spearphishers lured victims with subject (Hi, this is Microsoft calling. lines related to the Middle East, then took them to malicious websites hosting an Adobe We’ve seen a problem on your Flash zero-day exploit code to attack several ministries. Once the exploit was successful, PC …) and so on.” a variant of the Sednit malware (backdoors and information stealers) often used by Pawn Storm was dropped onto the victim’s machine.9 6 “Phishing Education Can Save Nearly $4m Annually,” Infosecurity Magazine, Aug. 26, 2015, www.infosecurity-magazine.com/news/phishing-education 7 “Lessons Learned from DigiNotar, Comodo and RSA Breaches,” SecurityWeek, Nov. 17, 2015, www.securityweek.com/lessons-learned-diginotar-comodo-and-rsa-breaches 8 “RSA SecurID Breach Cost $66 Million,” InformationWeek, July 28, 2015, www.darkreading.com/attacks-and-breaches/rsa-securid-breach-cost-$66-million/d/d-id/1099232? 9 “Russia-linked Pawn Storm Attackers Exploiting New Adobe Flash Zero-Day,” SecurityWeek, Oct. 13, 2015, www.securityweek.com/russia-linked-pawn-storm-attackers-exploiting-new-adobe-flash-zero-day and “Adobe Patches Flash Zero-Day Exploited by Pawn Storm,” SecurityWeek, Oct. 19, 2015, www.securityweek.com/adobe-patches-flash-zero-day-exploited-pawn-storm 10 Federal Trade Commission, www.consumer.ftc.gov/articles/0003-phishing SANS ANALYST PROGRAM 2 Guarding Beyond the Gateway: Challenges of Email Security Targeted Attacks: Where the Threat Lies (CONTINUED) Whaling is a type of BEC that uses well-thought-out, socially engineered scams that con unsuspecting high-level staff members at businesses to get to the company money or to phish deeper into the company.11 Lessons Learned Spearphishing 1. Social engineering attacks are becoming more sophisticated, particularly Highly targeted phishing spearphishing. attempts directed at specific 2. Targeted spearphishing attacks succeed because they seem legitimate to the individuals or companies that user and to the secure email gateway. have something in common. 3. Senior-level employees are often targets. These are usually well- 4. Even experts and senior-level employees can be victimized by social researched, customized emails engineering. that appear very believable and 5. Assess your email users and the data and access that is of value to attackers. seem to come from a trusted sender.13 6. Pay special attention to who is most likely to fall victim to a social engineering attack, such as executives, financial personnel and HR staffers. Whaling A malware-less attack that Vertical Targets attempts to get high-level users, Spearphishers also target verticals such as financial, government and health care particularly with C-level titles, because of the data their email users have access to. Health care is especially vulnerable politicians and celebrities, who to email-related exposure because one personal health care record is enough to start criminals consider “big fish,” entire new identities. In March 2015, Beacon Health System discovered it had been the to expose their credentials or target of a sophisticated phishing attack that affected more than 300,000 individuals. sensitive information.14 During the investigation, Beacon found that the compromise may have started as early as November