Do you know the dangers to your organisation if your email strategy is ineffective?
Email is one of the most popular ways to communicate for business and it’s also the prime target for cyber criminals. Essentially, your email is an open door for an attack without the right security practices in place.
Ineffective email strategy can lead to:
- Data Theft / Intellectual property loss
- Financial Loss
- Costly downtime, or worse: closure of your business
Before we talk about email security best practices, let’s understand the threats to your enterprise email and how they can harm your business.
Threats to your Enterprise through Email delivered attacks:
Phishing:
The act of acquiring private and sensitive information via an email that users believe is real. Phishers would be asking you to provide critical information; like account credentials, credit card numbers, personally identifiable information.
Malware:
Malware delivers attacks via email that could encrypt, delete sensitive information, steal, hijack or alter network functions or even spy on users’ activity. The intent is to disrupt, damage or destroy.
Ransomware:
A type of malware that is delivered to block access to the network so cyber criminals can demand a sum of money (a ransom) giving you access back once paid.
Spear Phishing (or sometimes called Whaling):
A highly targeted version of phishing. Attackers send emails from a trusted sender to obtain sensitive information.
Social Engineering Attacks:
Hiding the identity of a user by pretending to be another trusted user – all with the intent of gaining access to sensitive data.
Keyloggers:
Sent as spam, this is software that can log every keystroke that the user makes. It’s a common email threat which captures passwords, messages, credit card information, bank IDs etc.
Internal Users:
Usually unintentional acts by employees who inadvertently send sensitive information by email outside of your network.
Best Practices to keep your Enterprise Email protected from threats.
Employees: Educating your employees should be a considered priority in defending against cyber attacks.
Training is essential for all employees. Cyber Awareness should address a number of areas and outcomes, including:
- Training is essential for all employees. Teaching users the value of sensitive data, the consequences of a phishing attack etc. Regular training will keep staff updated and remind them of the importance of being cautious and keeping data safe across an organisation.
- Showing staff as to what to look out for i.e., what a suspect URL looks like, emails that are soliciting and prompting to share sensitive data.
- Email etiquette: checking recipients, be cautious on reply all, be aware of sensitive information being sent within and outside of the organisation.
- Password Security – best practices for password creation such policies requiring 12 – 16 characters, using a mix of letters, numbers and special characters.
- Why the installation and use of Multi Factor Authentication can be used to dissuade attackers from using compromised account.
Technology:
There are many technology based applications that can protect your business. Such technologies should form part of a deference in depth strategy. Implementing an Email Security Gateway is a cost effective way to reduce the email attack surface.
An effective system will include:
- Advanced threat detection to filter: Malware, Spam etc. This software is designed to prevent unwanted emails and allow the “good” emails in – using a whitelist and blacklist approach
- Email encryption
- Manage IP and URL Blacklists
- Spam Tagging
- A cloud backup – protect your files from deletion or corruption
The above list is just some of the mechanisms that can be used to protect your enterprise.
Working with a cybersecurity professional, like Secure ISS, we can advise your business on how to assess your security risks and determine where vulnerabilities lie. After consultation, Secure-ISS can provide you with guidance around the prioritisation of solution(s) for your business.
Experts in cybersecurity, Secure ISS offer a FREE Cyber Security Health Check. Contact us now for solutions to your enterprise email security.
Recent Comments