The Current State of Email Security 1

The Current State of Email Security 1 The Current State of Email Security The Current State of Email Security 1 Table of Contents SECTION 01 State of the Industry ..............................................................................................................02 SECTION 02 External Threats ......................................................................................................................05 SECTION 03 Internal Threats ....................................................................................................................... 19 SECTION 04 Protect Your Organization and Reduce Risk ...................................................................28 The Current State of Email Security 2 State of the Industry State of the Industry The Current State of Email Security 3 Today’s businesses rely heavily on email to Concerns Posed by communicate with clients, partners, and Different Email Threats colleagues. But research suggests that % Who Ranked them in their Top 3 Concerns organizations are lacking when it comes to protecting themselves against the increasing Has Direct Experience No Direct Experience number of customized and complex attacks. With Hack With Hack Viruses IT security pros 51% without direct hack When polled by Mimecast, 83% of IT security experiences are more 65% likely to rank viruses managers said they see email as a primary and malware among Malware their top three email source of attack, yet 65% claim they aren’t fully 51% security concerns... equipped to resolve the risks associated with 64% email threats. Respondents’ perceptions of Spam primary security threats also appeared to change 31% 32% based on having experienced a successful Insider Threat/Employee Data Leakage breach. However, viruses, malware, spam, and 34% insider threats remain the top concerns for 29% both groups, both with and without breach Financial Fraud/419 Crime experience. 24% 27% Similarly, security vendor Proofpoint reports that Spear-Phishing 21% email continues to be the primary threat. In the 25% first quarter of 2016, malicious email volume Ransomware increased by 66% from the previous quarter, with 20% attachments as the preferred delivery method 24% Social Engineering over embedded links. ...while those with 24% recent, direct 15% experience are more likely to be Offensive/Inappropriate Content concerned by social engineering and 20% other threats. 11% Cyberbullying and Harassment 24% 10% “Business Email Threat Report,” 2016, Mimecast State of the Industry The Current State of Email Security 4 Thanks to cloud computing and ubiquitous Today, mitigating security risks requires that broadband, today’s employees can usually send companies take a holistic approach to finding the and receive email from any location and from right solution by considering the mindset of the any device—both a blessing and a curse. This attacker, the various threats present, and current complicates email security, as any feasible solution trends. Whether your chosen email solution is must cater to multiple platforms and devices. located in the cloud or on-premises, assessing both external and internal threat risks is essential. Hackers are professionals at what they do, and they don’t follow any set rules. In addition to This report explores email security threats’ most more common security threats, email is often a common delivery methods and identifies their vehicle for more sophisticated attacks. Phishing, risks to your organization, offering effective for example, uses email to gain network entry, solutions to both internal and external threats which could lead to malware installations, and how to implement them. credential theft, and more. While email remains a primary threat, we cannot ignore that email security must be part of a larger cybersecurity defense policy. Birth and Rebirth of a Data Breach Email in hihin Peron er eto alare ntallation Email lter Attachment ehaior e of Stolen Steal Creential Creential irect ntall acoor C am Payment S Terminal alare Scraer Eort ata Controller “Data Breach Investigations Report” 2016, Verizon The Current State of Email Security 5 External Threats External Threats The Current State of Email Security 6 Given its high usage, it’s no surprise that email remains a primary target for those who wish to disrupt business operations or acquire confidential data. But what exactly motivates attackers to do what they do? In a Ponemon Institute survey of more than 300 technically proficient hackers, 69% claimed financial motivation, with 72% confirming that they select the easiest target first. What stops a hacker in his or her tracks? Looking for easy targets, 69% of the Ponemon survey respondents would quit an attack if the target had a strong defense. But the reality is that hackers continue to become more agile; 67% of surveyed respondents can more swiftly facilitate attacks due to an increase in the number of exploits and vulnerabilities. Why Time to Plan and Execute an Attack Has Decreased More Than One Response Permitted Increased Number of Known Exploits and Vulnerabilities 67% Improved Skills as a Hacker 52% Improved Hacking Tools 46% Improved Collaboration Within the Hacking Community 22% Improved Intelligence About Targeted Organizations 20% Other 4% “Flipping the Economics of Attacks,” 2016, The Ponemon Institute External Threats The Current State of Email Security 7 Don’t Be An Easy Target For security professionals, the message Wide-ranging threats exist, with is clear: The best defense is a good each serving a specific purpose and offense, and protecting against inbound disrupting users to varying degrees. email threats is essential for business Some are little more than annoyances, continuity. while others require specialized knowledge to detect and remove. Email Threat Types Level of Threat of Level “Types of Malware,” 2016, Kaspersky Lab External Threats The Current State of Email Security 8 In addition to email threat types and hacker motivations, understanding attackers’ go-to techniques is a big part of a holistic strategy. Attackers gain access to their desired target credentials in four primary ways: 1. GUESSWORK: 3. VIRUS ATTACK: Repeatedly trying combinations of usernames Embedding a virus in an email to gather and passwords using automated tools and a list the required information behind the scenes of keywords gathered during online research of or grant network access that allows the target data collection 2. FRAUD: Using the same list of keywords to compose 4. SOCIAL ENGINEERING: emails directing the recipient to interact with a Using a direct request disguised as a well-known financial institution, social network, trusted contact or vendor by clicking on a link Let’s look at each of these attack methods in greater detail, highlighting the threat types used in each. Bear in mind that attackers are versatile, typically using a variety of methods and combinations of threat types. External Threats The Current State of Email Security 9 Guesswork Guesswork has little to do with email security, apart 36% from one very important consideration: Email of surveyed respondents work accounts, mail server administrator accounts, and in organizations where IT staff more are secured using usernames and passwords. share the same passwords. “Annual Security Report,” 2016, Cisco Password strength can determine how long it takes an attacker to access an email. Brute force attacks have a single goal: to acquire credentials. Employees need strong passwords as a first line of defense. But according to a Lieberman Software survey, 36% of respondents work in organizations where IT staff share the same passwords, which adds risk of a successful attack. In addition, 55% changed user passwords more frequently than administrative passwords, which is risky, since admin passwords have more system controls and should be changed more regularly than users’. A 2016 Cisco study notes that 35% of its respondents faced brute force attacks. Pay careful attention to password strength, as a seemingly innocent email can ask users to supply their login information, which provides an attacker with the necessary data to launch a brute force attack elsewhere in the organization. External Threats The Current State of Email Security 10 Fraud Email fraud can run the gamut from Adding another layer of annoying, non-threatening spam to complication, spear phishing’s targeted and non-targeted phishing more specific corporate target attacks, but how recipients handle them means that these emails typically determines the effects of the attacks. appear as internal messages from Some users may click on fake invoices a trusted company source, such presented as email attachments, while as the IT team. others may click on embedded links to sites that then launch a variety of attacks. The highest level of phishing, “whaling,” targets a specific person, Whatever the reason, one of the best such as a celebrity, political figure, or ways to reduce the risk of fraud is to business executive. In the business train employees so they are aware of world, this poses an increasingly common attack methods. They will greater threat to the level of identify potential attacks more readily clearance a high-ranking target may and also provide an additional layer of accidentally divulge. The emails used security for the organization. Common to ensnare these potential victims attack methods for email fraud include: often indicate personal or business knowledge of the recipient, typically PHISHING, SPEAR PHISHING, AND gathered

Load more