With business email compromise racking up some of the largest financial theft associated with cyber-crime, and the relentless use of phishing as a means to trick users into handing over user credentials and other personal and sensitive data to bad actors, security organizations need to take a hard look at how their email security solutions are protecting against these issues.
Between the move to cloud-delivered email solutions and the general belief that email security has become commoditized, few are prioritizing email security as a top investment priority for the coming year. Yet there’s a ton of innovation happening in email security to help fight phishing, business email compromise (BEC) attacks, and leakage of the sensitive data that lives within the vast array of email mailboxes.
Email Continues as the Lifeblood of Communications
As much as I’d like to say that email plays less of a role in today’s business communications, it continues to be the lifeblood of daily communications for most workers. In addition to communication, most workers use email as their “uber-filing-system,” packing away emails received and sent, with little regard for any sensitive data that exists within them. Further, email addresses often act as core identifiers that get reused to access multiple applications, with 63% of ESG research respondents reporting that they use the same password to access multiple work devices and/or applications.
Traditional Email Security
For a long time, email security was about preventing the transport of malware, as attackers leveraged email to trick users into executing various types of malware attachments to compromise an endpoint. While secure email gateways (SEGs) are commonplace to prevent these kinds of attacks, SEGs often lack the ability to protect against more advanced, modern, email-borne attacks.
Email-borne Threats
Over the past few years, new types of harder-to-identify threats have emerged, continuing to leverage techniques that fool workers, convincing them to open malicious attachments, click on malicious links, and carry out malicious actions as instructed by impersonated senders. These activities facilitate credential theft, PII theft, and the fraudulent transfer of money into the hands of criminals.
Modern email-borne threats are facilitated by:
New Email Security Options
Fortunately, new security solutions are rapidly becoming available that monitor for behaviors that align with these modern attacks. The use of natural language processing is enabling security solutions to track expected communications and content behaviors, warning or stopping malicious activities. Email sender verification using DMARC, DKIM, and SPF are helping organizations limit impersonation attacks.
Next-gen email solutions from emerging security vendors like Valimail, Greathorn, Armorblox, and Abnormal Security together with market leaders like Mimecast, Proofpoint, Fortinet, Cisco, Symantec, and Trend Micro are leveraging these approaches to strengthen email security to protect against these plaguing email threats.
The threat landscape associated with email is rapidly changing, so security teams need to pay close attention to ensure that their email security solutions can keep up. Don’t assume that your current SEG has you covered. Help is out there but focus and attention to this evolving threat vector is required.
Dave Gruber is a senior analyst at Enterprise Strategy Group (ESG). Read more ESG blogs here.
