Email Security: The Dangers of the Inbox

Every now and then, an email with a catchy subject line appears in your inbox and you end up clicking on it, either because you’re curious about the subject line or because you assume the sender is trustworthy. Unfortunately, this is how most cyber attacks tend to begin – with a single click.

What unfolds next only puts your security and the security of your business in grave danger. Whether you clicked on a link or the unsubscribe button in the email, you would have potentially opened the floodgates to the possibility of single or multiple cyber attacks that could hold your business’ future hostage.

According to ProofPoint’s Human Factor 2019 report, more than 99% of cyber attacks require human interaction to succeed. That’s why email security should be at the very top of your business’ cybersecurity concerns.

This blog will help you understand how cyber criminals use emails as their weapon of choice, what are the top cyber threats making their way into your inbox every day, and how increasing your email security can go a long way to bolstering your business’ security posture.

The Art of Cyber Deception

There’s a greater psychological undercurrent to cyber attacks than you might think. Cyber criminals are hitting their targets by deceiving you and making you act irresponsibly, and in the midst of the Covid chaos, more consistently than ever before.

They are constantly developing and deploying sophisticated social engineering tactics to fool unassuming recipients. “They quickly adapt and keep the number of targeted users low. This makes it really hard to detect,” explained Elie Bursztein, (Leader Google’s anti-abuse research team), from observations of how attackers have been updating their designs to make them more efficient.

Regarding phishing emails alone, Google reported that 68% of phishing emails blocked by Gmail were new variations that were never seen before.

Cyber crime is constantly evolving to match advancements in technology. Being overconfident about your defenses or defensively underprepared is certainly not a viable stance anymore. It’s time to adopt a proactive approach rather than a reactive one to counter this deception.

Cyber Threats That Infiltrate Your Inbox Regularly

Before we talk about how you can build a formidable defense and increase email security, let’s take a look at the top cyberthreats that frequently make their way into your inbox and wreak havoc.

• Phishing/Spoofing/Identity Deception – Phishing involves hackers deploying various social engineering tactics to tempt users into clicking on malicious links and unwittingly giving up confidential information, such as user credentials. Hackers invest a tremendous amount of effort into assuming the identity of a trusted source, making sure that it is YOU who lets them into the system. Once they’re in, they can either install malware on your network’s systems, access and misuse sensitive data, or simply lock your systems and demand a hefty ransom.

Data suggests that this menace is only growing stronger. Verizon’s 2020 Data Breach Investigation Report stated that 22% of all breaches in 2020 involved phishing. The fact that even well-informed users fall prey to such attacks adds to this conundrum. In a study conducted by BullPhish ID, it was observed that 18.6% of users that clicked on simulated phishing campaigns demonstrated a willingness to submit credentials or requested data.

• Business Email Compromise (BEC) and Spear Phishing – In a business email compromise (BEC) scam, the attacker hacks into your business email account to impersonate employees or any of your organization’s important leaders with intent to defraud your company and its stakeholders into sending money or sharing sensitive data. Spear phishing works in a similar fashion wherein the attacker dupes the user by creating a façade that the malicious email originated from a trusted source.

A GreatHorn report stated that BEC attacks ballooned by nearly 100% in 2019. If you want to get a fair idea about the damage a BEC scam can do to your business, take a minute and think of the massive financial and reputational loss your business would suffer if an attacker impersonates you and carries out fraudulent activities in your name.

Let that sink in as we move on to the next threat.

• Account Takeovers – Taking identity impersonation one step further, account takeovers exploit your compromised user credentials to target both your business’ and your financial stability and reputation. Cyber criminals can go to the extent of accessing other accounts, such as bank accounts and financial statements, to carry out fraudulent transactions. The 2020 Global Identity and Fraud Report by Experience revealed that 57% of enterprises reported higher fraud losses due to account takeovers.

Simply put, the attacker will not just target your business, but utilize it as a gateway to also exploit customer data simultaneously.

• Malicious Malware and Viruses – Although used interchangeably, malware and viruses differ on technical grounds. Malware refers to any type of malicious software, irrespective of how it works, but a virus is a specific type of malware that self-replicates after entering other programs. Nonetheless, both pose an enormous threat to your business’ IT environment and email security.

CSO Online revealed that 92% of all malware is delivered via email. Businesses must bolster email security to decrease the amount of malware delilvered to have a chance to survive. As mentioned earlier, all it takes is a simple click for an attacker to gain access to your network’s systems and plant malware or a virus.

• Ransomware – A ransomware attack occurs when a hacker breaches your network’s security, encrypts your data and demands a hefty ransom for the restoration of that data. Now imagine your business coming to a complete standstill until you pay the ransom demanded. Not a pretty picture by any means!

To put this into perspective, in Q2 2020, average ransom demands were pegged at $178,254, which was 60% higher than in Q1 2020 and a whopping 432% higher than in Q3 2019 ($41,198).

Investigations performed on previously confirmed Ransomware attacks to date, have not shown definitive evidence of theft or exposure of data, only the encryption. However, to add to the ongoing chaos that is 2020, within the last year, there has been change up in the behavior of Ransomware hits. These cyber bullies have changed tactics and are now claiming to EXFILTRATE COPIES of business DATA BEFORE encrypting it! They are then leveraging an additional blackmail threat to include exposing the data if the ransom demand is not paid.

Even if you opt to pay the ransom, you have no guarantees the attackers would provide the means to decrypt and restore data, nor can you be certain the data will not be sold, exposed or targeted for a direct attack at some later date.

• Insider Threats: The Human Element – Insider threats are posed by individuals within your organization or closely related to it, such as current or former employees, vendors and partners. Acting unwittingly or out of malice, they can easily let an attacker into the system, leaving all your sensitive data exposed.

In fact, according to Verizon in their 2020 Data Breach Investigation Report, over one-third of data breaches worldwide involved internal actors. An Egress study revealed that 31% of employees have mistakenly sent an email containing sensitive data to the wrong person.

While your confidence in your employees is well-founded and justified, we ought to remind you – to err is human!

• Misconfigurations – Last but certainly not the least deadly, misconfigurations in your email platform can expose your network to a host of threats. For example, it could allow the sending of emails without authentication. We’re pretty sure you know what would happen if a cyber criminal exploited this vulnerability and sent out emails impersonating anyone from the company’s executive level. Before you know it, you’d be knee deep in managing a full-blown PR crisis.

Email Security Requires More Than Spam Filtering

Email remains one of the most effective tools cybercriminals use to target businesses. Phishing campaigns, credential theft, ransomware delivery, business email compromise, and social engineering attacks often begin with a single message that appears legitimate.

Protecting your organization requires more than filtering unwanted email. Effective email security combines strong authentication, employee awareness training, access controls, endpoint protection, phishing defenses, secure backups, and ongoing monitoring. When these safeguards work together, organizations are better positioned to detect threats, prevent compromise, and reduce the impact of successful attacks.

The most resilient organizations recognize that email security is not a one-time project. It is an ongoing process of improving defenses, educating employees, and adapting to evolving threats.

The inbox will likely remain a primary target for attackers. The question is whether your organization is prepared to defend it.

Is Your Organization Protected Against Today’s Email Threats?

Many businesses rely on basic email filtering but never evaluate whether their overall security posture adequately protects against phishing, credential theft, ransomware, and other email-based attacks. If you’d like help identifying potential weaknesses and strengthening your defenses, schedule a free consultation with ITNS Consulting.

We’ll help assess your current environment, evaluate email security controls, identify vulnerabilities, and develop a practical roadmap for reducing cyber risk and improving resilience.

Build a Stronger Cybersecurity Foundation

Email attacks are often successful because foundational security controls are missing or inconsistently applied.

Download our Cybersecurity Baseline Checklist to evaluate essential security controls, identify potential gaps, and take practical steps to better protect your organization from phishing, ransomware, credential theft, and other cyber threats.