Types of Email Security Solutions to Prevent Threats
 

Email’s primary benefit is also its biggest shortcoming from a security perspective: It is universally accessible. Even with collaboration platforms like Microsoft Teams and Zoom growing in popularity, email remains the most common way for businesses to communicate internally and with the outside world.

But this convenience comes at a cost. According to Verizon, email was the No. 1 delivery method for 94% of malware attacks in 2019.[1]

From classic phishing to more sophisticated business email compromise (BEC), attacks by cybercriminals are constant and continue to evolve. Companies need to be proactive in building multifaceted defenses. And they are increasingly using cloud-delivered email security solutions, according to Gartner’s Market Guide for Email Security.

The imperative to secure emails has only intensified due to remote working during COVID-19. In 2020, email threats rose by 64%, according to Mimecast’s recent State of Email Security report. With all signs pointing to a hybrid home/office working model in the future, businesses must ensure that their staff can continue to work securely from any location.

What is Email Security?

Email security involves various techniques to secure the access to and content of email accounts. It safeguards companies’ sensitive information and brands from loss, theft or compromise while protecting business continuity.

Money motivates most email-borne attacks, Verizon says, and methods vary, as seen below. Essentially, though, an attacker sends a misleading message to a recipient’s email address hoping they will open an infected attachment, share sensitive details about their organization or click on a link that installs malware on their device.

Biggest Threats to Business Email Security

Below are some of the most serious threats to email security employed by attackers today.

• Ransomware: A form of malware, ransomware works by encrypting a recipient’s data and asking them to pay a fee to recover it.
• Spam: Spam is junk mail taken to the extreme. A spam attack involves a barrage of emails designed to get through your organization’s sorting filters, or to hide more targeted attacks launched in parallel. Even with enterprise filtering tools, businesses still struggle to manage spam, which accounts for nearly 30% of all email traffic.[2]
• Phishing: With phishing attacks, malicious actors try to establish themselves as a trusted entity and dupe employees into sharing their usernames, passwords or payment details. While the success rate of phishing emails is relatively low, attackers are relentless in both the cadence and volume of emails they send, which is why some recipients still fall victim to their efforts. By one estimate, 85% of businesses have been hit by at least one phishing attack.[3]
• Spear phishing: Compared to simple phishing, which is like casting a trawling net along the ocean floor, spear phishing targets one or a few recipients with clear intent. In these cases, an attacker researches their target (often a high-ranking employee or their assistant) and impersonates one of their trusted business partners or colleagues. This makes spear phishing attacks very difficult to spot. One recent attack targeted two new CEOs at high-profile companies before their appointments were even officially announced.
• Business email compromise (BEC): The mechanism of business email compromise varies, but the aim for attackers is to take over your professional email address to trick correspondents into sending money or sharing sensitive information. For instance, an attacker might target an organization’s finance team to send forged invoices to third parties.[4]
• Internal email threats: Your staff can unintentionally become a gateway for external attackers due to human error. After all, most email security threats depend on an employee opening a malicious message or link. This makes it crucial to stay on top of internal emails and conduct employee awareness training.

Types of Email Security to Counter Attacks

Effective email security boils down to a mix of powerful technology and constant education that protect your company at, within and beyond the perimeter of your network.

At your network’s perimeter, URL protection and browser isolation combine to form a wall of defense against suspicious web links and browser malware. Complementing these are protections against impersonation attempts and malicious attachments, which form the bulk of phishing attacks.

Inside the perimeter, employees are the key to controlling threats that make it into their inbox. Awareness training can reduce the risk of negligence or human error, which remain major gaps in most business email security systems. Beyond the perimeter, you need to protect against brand impersonation by attackers spoofing your web domain.

Below is Gartner’s breakdown of common attacks and the types of email security used to neutralize each, or at least minimize your risk.

Protection Against Infected Attachments

• Network sandbox: Using a network sandbox, security professionals can analyze attachments in an isolated coding environment where they pose no threat to your core business network. The aim here is to test attachments that are not explicitly dangerous but might still pose a threat, similar to the way scientists handle toxic substances in an isolated environment with its own ventilation system in case of a leak.
• Content disarm and reconstruction (CDR): Also known as content sanitization, content disarm and reconstruction is the process of breaking down suspicious attachments into their constituent parts, stripping out any elements that might pose a threat, and rebuilding them into a safe version that poses no threat. The advantage of CDR is that it removes any element of a file that doesn’t align with your company’s security parameters, which means it protects against new threats that other mechanisms may not recognize.

Protection Against Suspicious URLs

• URL rewriting and time-of-click analysis: By rewriting suspicious URLs before they are delivered to the recipient, this approach achieves one of three goals. The link is either converted into a non-clickable version, thus disarming it; removed from the message entirely; or redirected to an inspection service for time-of-click analysis.
• Remote browser isolation (RBI): Put simply, RBI sends users to an external browser when they click on a suspicious link, ensuring that security risks (especially malware) are isolated from the business network. When using RBI, users can only interact with clean website content because dangerous content is not rendered for them to see.

Protection Against Impersonation and Social Engineering Attempts

• Display name spoof detection: Display name spoofing is a form of BEC attack whereby an email’s display name is made to look like it comes from a trusted source. Modern detection techniques can help defend against spoofs by advanced keyword analysis and the monitoring of sender-recipient relationships.
• Domain-based message authentication, reporting and conformance: Domain-based message authentication, reporting and conformance (DMARC) is a protocol to authenticate that inbound emails from a specific domain are using that domain legitimately. DMARC can be highly effective in defending your business against fraudulent messages.
• Lookalike domain detection: Lookalike domains are designed to be almost identical to legitimate domains, with only slight modifications made to the domain name. Today’s email security solutions allow administrators to create and maintain a list of suspicious lookalike domains, giving employees a resource to help them avoid scams.
• Anomaly detection: Sophisticated attacks might get around traditional email security defenses. Anomaly detection uses telemetry and data intelligence to detect deviations from normal email behavior that point to advanced forms of spam and phishing.

Protection Against Human Error

• Anti-phishing training: Even the most advanced email security solutions are occasionally infiltrated. The best defense against phishing attacks is a well-trained and vigilant workforce. Anti-phishing training is an increasingly popular way for businesses to improve the human layer of their email security defenses.
• Avoiding data loss: A single misdirected email can have major security implications for your business. To reduce the likelihood of human error, a growing number of security vendors combine models based on data loss prevention and artificial intelligence to flag potential misdirection errors.

The Bottom Line

The first step in building a robust email security infrastructure is to understand the threat. From there, your company can invest in the right types of email security to serve its specific needs. By leaning on these solutions and driving employee awareness, your business can develop a comprehensive defense against the range of cyber threats we face today.

[1] “2020 Data Breach Investigations Report,” Verizon

[2] “Global Spam Volume as a Percentage of Total E-mail Traffic from 2007 to 2019,” Statista

[3] “Staggering Phishing Statistics in 2020,” Security Boulevard

[4] “New Spear Phishing Emails Target C-suite Executives, Assistants and Financial Departments,” Security Magazine