The Definitive

Email Cybersecurity

Strategy Guide

A people-centric approach to stopping ransomware, malware attacks, phishing and email fraud.

Email: Your Most Critical Threat Vector

Every day around the world, a silent battle wages on in one of the most

familiar and central features of modern work: the email inbox. As the top malware delivery vector and fertile ground for all kinds of fraud, email is the channel where cyber attackers are most likely to compromise their targets. They trick users into clicking on an unsafe link, giving away their credentials, or even carrying out commands directly (such as wiring

money or sending sensitive files).

It’s not hard to see why attackers prefer email. It uses a decades-old architecture that wasn’t designed with security in mind. It’s universal. And unlike computer hardware and infrastructure, email attacks exploit vulnerabilities that can’t be patched: people.

The challenge is growing even more complicated amid a shift to the cloud and remote work. Organizations spend billions every year on security tools designed to harden the network perimeter, detect network intrusions and secure endpoints. And yet the volume—and costs—of ransomware, business email compromise (BEC), credential phishing and malware-fueled data breaches have never been higher. That’s because today’s attacks hack human nature, not just technology. And email is the easiest way to reach people.

Cyber Attacks Are Evolving Faster Than Traditional Defenses

Safeguarding email is the key to protecting the enterprise. But it’s a complex challenge. That’s because email threats are numerous and wide-ranging. Attack techniques are constantly evolving. And human nature—the weak link in every organization—is a perpetual target. It’s no wonder that solutions built for fighting the attacks of just two to three years ago are struggling to keep up.

Here are just some of the ways cyber attackers target people.

Ransomware

Ransomware is an old threat that persists as a modern-day problem. This type of malware—which gets its name from the payment it demands after locking away victims’ files—is a major issue for modern businesses. It’s one of today’s most disruptive types of cyber attack.

Major incidents involving fuel, food and health infrastructure in 2021 showed that no target is off limits.

About three-quarters of ransomware starts, directly or indirectly, with a phishing email. These emails trick users into opening a malicious attachment or clicking a malicious URL.

Email fraud and business email compromise (BEC)

Business email compromise (BEC), also known as email fraud, is one of

cybersecurity’s costliest and least understood threats. The fast-growing category of email fraud doesn’t always garner as much attention as other high-profile cyber crimes. But in terms of direct financial costs, BEC easily overshadows other types.

In 2020 alone, BEC schemes cost organizations and individuals more than $1.8 billion. That’s up more than $100 million from 2019 and a full 44% of total cyber crime losses.

BEC attacks are hard to detect. They don’t include the usual payloads—malicious URLs or file attachments—to analyze. Instead, fraudsters rely on impersonation and other social engineering techniques to trick people.

Many of today’s BEC schemes are highly sophisticated, well-funded and backed by careful planning and research. A growing number of attackers are focusing their efforts on supplier invoicing fraud and large business-to-business (B2B) transactions they can hijack.

BEC attacks prey on human nature. They exploit people’s trust.

Account compromise/takeover

Account compromise is the act of maliciously gaining control over a legitimate user’s email or cloud service account—giving the attacker wide-ranging access to data, contacts, calendar entries and email.

Beyond the compromised user’s data, the attacker can use the account to

impersonate the user in social engineering attacks both inside and outside of the organization. These include BEC, supply-chain attacks and more.

Threat actors can access sensitive data, persuade users or outside business partners to wire money or damage an organization’s reputation and finances.

Worse, they can also install backdoors to maintain access for future attacks.

How the Threat Landscape Has Changed

Today’s remote and hybrid workforces are powered by cloud and mobile technologies.

The hardened perimeters and traditional network structures of the past are all but gone. People are the new perimeter.

Unfortunately, most security budgets—tied to other priorities and product categories—haven’t kept up.

Organizations may understand the multifaceted, people-centric nature of today’s threats and invest in security tools to cover every potential risk.

But unless those tools are working together in a coordinated fashion, they can’t offer the visibility and insight security teams need to manage risk. true people-centric security requires a holistic, coordinated approach.

Focus on Your Riskiest Users

The first step to protecting users is identifying which ones pose the most risk. While every organization may weigh various risk factors differently, all should comprise some combination of vulnerability, attacks and privilege.

Vulnerability is a way of determining who’s most likely to fall victim to a threat. An attack analysis can reveal who in your organization is being targeted, how heavily and by what types of threats. And privilege can help predict how harmful a successful attack would be to the organization.

Focus on users who represent a higher-than-normal risk based on any combination of these factors. Their status calls for extra attention by the security team and stakeholders who should know how and why they’re at risk.

This level of visibility in all three areas is essential to people-centric security. Without it, organizations have no way of knowing who needs additional layers of security or how best to protect them.

A people-centric approach keeps everyone protected by applying controls that correspond to their level of risk.

And it works in a unified way across every platform people use, against every tactic attackers employ and within every threat vector that matters.

Source: Proofpoint